Apicurio Registry 3.3.1 closes XSS, SSRF and XML parsing flaws

Red Hat has released Apicurio Registry 3.3.1 GA container images with fixes for six security vulnerabilities affecting Red Hat Integration Service Registry. The August 25 advisory rates the update Important and tells administrators to apply it after any earlier errata relevant to their systems.

What changed

The update addresses two DOMPurify cross-site scripting issues. Red Hat describes CVE-2026-49978 as a cross-site scripting vulnerability that allows code execution and CVE-2026-41240 as an inconsistent tag-sanitization flaw.

Three of the fixes are specific to Apicurio Registry’s handling of XML-related inputs. CVE-2026-12975 concerns an unhardened SAX parser used during content-type detection; the advisory says it can lead to blind XML external entity processing, server-side request forgery or a “billion laughs” denial of service. CVE-2026-12992 covers SSRF through import dereferencing during full WSDL validation. CVE-2026-12993 addresses denial of service through XML entity expansion in an internal DTD subset.

The sixth issue, CVE-2026-44496, is an Axios client-side denial-of-service flaw involving unescaped regular-expression metacharacters in an XSRF cookie name.

Who is affected

Red Hat lists Red Hat Integration — Service Registry 1 on x86_64 as the affected product and says the update is delivered through new Red Hat build of Apicurio Registry container images in the Red Hat Container Catalog.

The most relevant exposure depends on how a registry deployment accepts and validates content. Environments that process untrusted schemas, WSDL documents or XML-derived formats should pay particular attention to the parser, import-dereferencing and entity-expansion fixes. The two DOMPurify items affect the client-side sanitization boundary, while the Axios issue is a denial-of-service condition.

The advisory does not collapse all six issues into one exploit path. Operators should treat the release as a bundle of fixes across the registry’s server-side validation and browser-facing dependency surface rather than assume that every deployment has the same exposure.

What operators should do

Red Hat’s prescribed action is to apply Apicurio Registry 3.3.1 GA after ensuring that previously released errata relevant to the system are installed. Teams running Service Registry should identify the deployed container image, plan a controlled image update and verify registry functions that parse or validate XML and WSDL content after rollout.

Because the advisory names both code-execution and server-side request-forgery consequences, delaying the update leaves more than a routine availability risk. Platform teams should also review whether registry endpoints accept content from less-trusted tenants or automated pipelines, since those input paths determine where the XML and WSDL validation flaws are reachable.