{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"apicurio/apicurio-registry-rhel8","product":"Red Hat build of Apicurio Registry 3.3.1","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"apicurio/apicurio-registry-rhel9","product":"Red Hat build of Apicurio Registry 3.3.1","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"apicurio/apicurio","product":"Red Hat build of Apicurio Registry 3.3.1","source":"ADP: redhat-SADP","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"registry-rhel8","versionType":"rpm"},{"lessThan":"*","status":"unaffected","version":"registry-rhel9","versionType":"rpm"}]}],"cveId":"CVE-2026-12992","cwes":["CWE-918"],"description":"A flaw was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.wsdl.importDocuments feature. When the VALIDITY rule is set to FULL, an attacker with Developer-role access can upload a WSDL document containing attacker-controlled import locations, causing the registry to issue HTTP requests to arbitrary internal URLs (server-side request forgery).","epss":{"date":"2026-11-04","percentile":0.27399,"score":0.00338},"exploits":[],"kev":null,"metrics":[{"score":7.4,"severity":"high","source":"CNA: redhat","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","version":"3.1"},{"score":7.4,"severity":"high","source":"ADP: redhat-SADP","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","version":"3.1"}],"modifiedAt":1793845123249,"publishedAt":1782422171720,"references":[{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:59360"},{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-12992"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2491691"},{"source":"ADP: redhat-SADP","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-12992"},{"source":"ADP: redhat-SADP","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2491691"},{"source":"ADP: redhat-SADP","tags":["x_sadp-csaf-vex"],"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12992.json"},{"source":"ADP: redhat-SADP","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:59360"}],"remediation":[{"kind":"fix","source":"ADP: redhat-SADP","text":"RHSA-2026:59360: Red Hat build of Apicurio Registry 3.3.1"}],"revision":"c957d89aaacc3578dcdb361928b16a1550de9bfe17d1aa63c30fd0dd8ac54cca","sources":[{"modifiedAt":1793845123249,"name":"CNA: redhat","retrievedAt":1793848179713,"url":"https://www.cve.org/CVERecord?id=CVE-2026-12992"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793848193931,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-12992"}],"ssvc":{"assessedAt":1782423341868,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Apicurio/apicurio-registry: apicurio-registry: ssrf via wsdl4j import dereference in wsdl full validation","updatedAt":1793848193931}