This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ws-xmlschema.git
The following commit(s) were added to refs/heads/master by this push:
new f9fb9e35 Updating website for 2.3.3 release
f9fb9e35 is described below
commit f9fb9e353042749bd290c97edaa8b3f6499ec07c
Author: Colm O hEigeartaigh <[email protected]>
AuthorDate: Tue Sep 29 11:55:14 2026 +0100
Updating website for 2.3.3 release
---
src/site/apt/index.apt | 8 ++--
src/site/apt/security.apt | 98 ++++++++++++++++++++++++++++++++++++++++++++++
src/site/site.xml | 22 +++++------
src/site/xdoc/download.xml | 18 ++++-----
4 files changed, 120 insertions(+), 26 deletions(-)
diff --git a/src/site/apt/index.apt b/src/site/apt/index.apt
index 501e3fe0..e331c230 100644
--- a/src/site/apt/index.apt
+++ b/src/site/apt/index.apt
@@ -5,12 +5,12 @@ Overview
into memory and analyze or modify them, or to create entirely new schemas
from
scratch.
- XMLSchema 2.0 is a major revision that takes advantage of the facilities of
Java 1.5. XMLSchema 2.3.x requires Java8 or higher.
+ Apache XMLSchema 2.0 is a major revision that takes advantage of the
facilities of Java 1.5. XMLSchema 2.3.x requires Java8 or higher.
For information on how to use the XmlSchema API, please
see the {{{./xmlschema-core/apidocs/index.html}javadocs}} or the
{{{./xmlschema-core/schematutorial.html}tutorial}}.
- XmlSchema eagerly welcomes suggestions, documentation,
+ Apache XmlSchema eagerly welcomes suggestions, documentation,
and most of all code. Please join our dev list, submit JIRA entries, and
attach patches.
@@ -22,6 +22,4 @@ Issues
Downloads
Most users incorporate XML Schema via maven. You can also download release
packages
- from {{{./download.html}downloads}}.
-
- -The XMLSchema Development Team (dev at ws.apache.org)
+ from {{{./download.html}downloads}}. The latest release is 2.3.3. Note that
this release fixes three CVEs, please see {{{./security.html}Security
Advisories (CVEs)}}.
diff --git a/src/site/apt/security.apt b/src/site/apt/security.apt
new file mode 100644
index 00000000..aafa3e28
--- /dev/null
+++ b/src/site/apt/security.apt
@@ -0,0 +1,98 @@
+~~ Licensed to the Apache Software Foundation (ASF) under one
+~~ or more contributor license agreements. See the NOTICE file
+~~ distributed with this work for additional information
+~~ regarding copyright ownership. The ASF licenses this file
+~~ to you under the Apache License, Version 2.0 (the
+~~ "License"); you may not use this file except in compliance
+~~ with the License. You may obtain a copy of the License at
+~~
+~~ http://www.apache.org/licenses/LICENSE-2.0
+~~
+~~ Unless required by applicable law or agreed to in writing,
+~~ software distributed under the License is distributed on an
+~~ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+~~ KIND, either express or implied. See the License for the
+~~ specific language governing permissions and limitations
+~~ under the License.
+
+ ------------------------
+ Apache XMLSchema - Security
+ ------------------------
+
+Security and CVE Tracking
+
+ This page tracks known vulnerabilities (CVEs) for Apache XMLSchema.
+
+ For reporting a new vulnerability, see
+ {{{https://www.apache.org/security/}Apache Security Team}}.
+
+Apache XMLSchema CVEs
+
+ * {{{https://www.cve.org/CVERecord?id=CVE-2026-102495}CVE-2026-102495}}:
+ Apache XMLSchema: Denial of service through unbounded recursion when
+ resolving schema imports and includes
+
+ * Severity: Low
+
+ * Affected versions:
+
+ - Apache XMLSchema before 2.3.3
+
+ * Description:
+
+ Apache XmlSchema doesn't limit how deeply schema imports and includes
+ can be nested, so a malicious schema can make parsing recurse until the
+ stack overflows. This causes a denial of service. Users are recommended
+ to upgrade to version 2.3.3, which fixes this issue.
+
+ * Credit:
+
+ This issue was found using Claude agents to study the security of
+ open-source projects (finder)
+
+ * {{{https://www.cve.org/CVERecord?id=CVE-2026-102496}CVE-2026-102496}}:
+ Apache XMLSchema: Denial of service through deeply nested schema
+ structures
+
+ * Severity: Low
+
+ * Affected versions:
+
+ - Apache XMLSchema before 2.3.3
+
+ * Description:
+
+ Apache XmlSchema doesn't limit how deeply schema structures can be
+ nested when it builds its schema model, so a malicious schema can make
+ parsing recurse until the stack overflows. This causes a denial of
+ service. Users are recommended to upgrade to version 2.3.3, which fixes
+ this issue.
+
+ * Credit:
+
+ This issue was found using Claude agents to study the security of
+ open-source projects (finder)
+
+ * {{{https://www.cve.org/CVERecord?id=CVE-2026-102497}CVE-2026-102497}}:
+ Apache XMLSchema: Denial of service through cyclic schema definitions in
+ the schema walker
+
+ * Severity: Low
+
+ * Affected versions:
+
+ - Apache XMLSchema before 2.3.3
+
+ * Description:
+
+ The Apache XmlSchema walker (xmlschema-walker) doesn't detect cycles in
+ type derivation, substitution groups, model groups or attribute groups.
+ A malicious schema with such a cycle can make the walker recurse until
+ the stack overflows, causing a denial of service. Users are recommended
+ to upgrade to version 2.3.3, which fixes this issue.
+
+ * Credit:
+
+ This issue was found using Claude agents to study the security of
+ open-source projects (finder)
+
diff --git a/src/site/site.xml b/src/site/site.xml
index d84b5fde..7b25b912 100644
--- a/src/site/site.xml
+++ b/src/site/site.xml
@@ -8,7 +8,7 @@
~ "License"); you may not use this file except in compliance
~ with the License. You may obtain a copy of the License at
~
- ~ http://www.apache.org/licenses/LICENSE-2.0
+ ~ https://www.apache.org/licenses/LICENSE-2.0
~
~ Unless required by applicable law or agreed to in writing,
~ software distributed under the License is distributed on an
@@ -25,19 +25,20 @@
<version>2.0.0-M11</version>
</skin>
<bannerRight>
- <src>http://ws.apache.org/images/project-logo.jpg</src>
- <href>http://ws.apache.org/</href>
+ <src>https://ws.apache.org/images/project-logo.jpg</src>
+ <href>https://ws.apache.org/</href>
</bannerRight>
<version position="none" />
<body>
<links>
- <item name="Apache" href="http://www.apache.org/"/>
- <item name="WebServices" href="http://ws.apache.org/"/>
+ <item name="Apache" href="https://www.apache.org/"/>
+ <item name="WebServices" href="https://ws.apache.org/"/>
</links>
<menu name="XML Schema">
<item name="Home" href="index.html"/>
<item name="Downloads" href="download.html"/>
+ <item name="Security" href="security.html"/>
<item name="Source Code" href="scm.html"/>
<item name="Project Information" href="project-info.html">
<item name="Mailing Lists" href="mailing-lists.html"/>
@@ -46,13 +47,10 @@
<item name="License" href="licenses.html"/>
</menu>
<menu name="Apache">
- <item name="License" href="http://www.apache.org/licenses/"/>
- <item name="Sponsorship"
href="http://www.apache.org/foundation/sponsorship.html"/>
- <item name="Thanks"
href="http://www.apache.org/foundation/thanks.html"/>
- <item name="Security" href="http://apache.org/security/"/>
+ <item name="License" href="https://www.apache.org/licenses/"/>
+ <item name="Sponsorship"
href="https://www.apache.org/foundation/sponsorship.html"/>
+ <item name="Thanks"
href="https://www.apache.org/foundation/thanks.html"/>
+ <item name="Security" href="https://apache.org/security/"/>
</menu>
</body>
</project>
-
-
-
diff --git a/src/site/xdoc/download.xml b/src/site/xdoc/download.xml
index 13189f43..ee29e46f 100644
--- a/src/site/xdoc/download.xml
+++ b/src/site/xdoc/download.xml
@@ -7,7 +7,7 @@
(the "License"); you may not use this file except in compliance with
the License. You may obtain a copy of the License at
- http://www.apache.org/licenses/LICENSE-2.0
+ https://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
@@ -29,24 +29,24 @@ schemas from scratch.
Use the links below to download a distribution of Apache XMLSchema from one of
our mirrors. It is good practice to verify the integrity of the distribution
files. Apache XMLSchema releases are available under the
-<a href="http://www.apache.org/licenses/LICENSE-2.0";>Apache License, Version
2.0</a> - see the
+<a href="https://www.apache.org/licenses/LICENSE-2.0";>Apache License, Version
2.0</a> - see the
LICENSE.txt and NOTICE.txt files contained in each release artifact.
</p>
</subsection>
<subsection name="Current official release (closest mirror site selected
automatically)">
<p>
-The current stable release is Apache XMLSchema 2.3.2:
+The current stable release is Apache XMLSchema 2.3.3:
</p>
<ul>
<li>
-<a
href="https://www.apache.org/dyn/closer.lua/ws/xmlschema/2.3.2/xmlschema-2.3.2-source-release.zip";>xmlschema-2.3.2-source-release.zip</a>
-(<a
href="https://downloads.apache.org/ws/xmlschema/2.3.2/xmlschema-2.3.2-source-release.zip.asc";>PGP</a>)
-(<a
href="https://downloads.apache.org/ws/xmlschema/2.3.2/xmlschema-2.3.2-source-release.zip.sha512";>SHA-512</a>)
+<a
href="https://www.apache.org/dyn/closer.lua/ws/xmlschema/2.3.3/xmlschema-2.3.3-source-release.zip";>xmlschema-2.3.3-source-release.zip</a>
+(<a
href="https://downloads.apache.org/ws/xmlschema/2.3.3/xmlschema-2.3.3-source-release.zip.asc";>PGP</a>)
+(<a
href="https://downloads.apache.org/ws/xmlschema/2.3.3/xmlschema-2.3.3-source-release.zip.sha512";>SHA-512</a>)
</li>
<li>
-<a
href="https://www.apache.org/dyn/closer.lua/ws/xmlschema/2.3.2/xmlschema-core-2.3.2-bin.zip";>xmlschema-core-2.3.2-bin.zip</a>
-(<a
href="https://downloads.apache.org/ws/xmlschema/2.3.2/xmlschema-core-2.3.2-bin.zip.asc";>PGP</a>)
-(<a
href="https://downloads.apache.org/ws/xmlschema/2.3.2/xmlschema-core-2.3.2-bin.zip.sha512";>SHA-512)</a>
+<a
href="https://www.apache.org/dyn/closer.lua/ws/xmlschema/2.3.3/xmlschema-core-2.3.3-bin.zip";>xmlschema-core-2.3.3-bin.zip</a>
+(<a
href="https://downloads.apache.org/ws/xmlschema/2.3.3/xmlschema-core-2.3.3-bin.zip.asc";>PGP</a>)
+(<a
href="https://downloads.apache.org/ws/xmlschema/2.3.3/xmlschema-core-2.3.3-bin.zip.sha512";>SHA-512)</a>
</li>
</ul>
</subsection>
