WSO2 Carbon API Gateway vulnerabilities

2 known vulnerabilities in WSO2 Carbon API Gateway from WSO2. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.7 High severity

  WSO2 API Manager: Improper Restriction of Recursive Entity References in DTDs

  CVE-2026-3415Aug 6, 2026WSO2

  The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during

• 7.5 High severity

  WSO2 API Manager: Improper Neutralization of Special Elements in Output Used by a Downstream Component

  CVE-2025-8154May 11, 2026WSO2

  In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses. By exploiting this vulnerability, a malicious actor can inj