WSO2 API Control Plane SchemaValidator Mediator resource consumption

Summaryinfo

A vulnerability identified as problematic has been detected in WSO2 API Control Plane, API Gateway, API Manager, Carbon API Gateway, Carbon API Management Implementation, Traffic Manager and Universal Gateway. This affects an unknown function of the component SchemaValidator Mediator. The manipulation leads to resource consumption. This vulnerability is documented as CVE-2026-3415. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in WSO2 API Control Plane, API Gateway, API Manager, Carbon API Gateway, Carbon API Management Implementation, Traffic Manager and Universal Gateway. It has been rated as problematic. This issue affects some unknown functionality of the component SchemaValidator Mediator. The manipulation with an unknown input leads to a resource consumption vulnerability. Using CWE to declare the problem leads to CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during validation operations. This behavior can occur when an attacker supplies crafted XML payloads to the relevant mediator flows with sufficient privileges. Successful exploitation may allow a highly privileged actor to read files accessible within the server hosting the affected product. Additionally, it may be possible to trigger outbound requests to unintended internal or external locations, depending on the server environment and network configuration. Specially crafted XML payloads can also lead to excessive resource consumption during parsing, impacting the availability of the product.

The advisory is shared at security.docs.wso2.com. The identification of this vulnerability is CVE-2026-3415 since 03/01/2026. The exploitation is known to be easy. The attack may be initiated remotely. The exploitation needs additional levels of successful authentication. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-2085). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• Open Source WSO2 API Manager

Productinfo

Type

• Automation Software

Vendor

• WSO2

Name

• API Control Plane
• API Gateway
• API Manager
• Carbon API Gateway
• Carbon API Management Implementation
• Traffic Manager
• Universal Gateway

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion