Apache
3,918 CVEs in 885 Apache products, including HTTP Server, Tomcat, Airflow. Newest: CVE-2026-113582 (2026-10-22).
Apache products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-113582 | High | 7.5 | 2026-10-22 | UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-si… |
CVE-2026-103634 | | 2026-10-22 | Out-of-bounds read and write in the Count-Min sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). count_min_sketch::deserialize() did… | |
CVE-2026-112381 | Medium | 5.9 | 2026-10-21 | Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origin response is being… |
CVE-2026-111817 | Medium | 5.3 | 2026-10-21 | Apache Traffic Server can stall a chunked transfer that it passes through with its trailers removed (proxy.config.http.drop_chunked_trailers) until the connect… |
CVE-2026-111815 | Critical | 10.0 | 2026-10-21 | Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verify_client… |
CVE-2026-111814 | Critical | 10.0 | 2026-10-21 | Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction conf… |
CVE-2026-111812 | Critical | 10.0 | 2026-10-21 | Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials. This… |
CVE-2026-111811 | Critical | 9.0 | 2026-10-21 | Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache. This issue affect… |
CVE-2026-111810 | High | 7.5 | 2026-10-21 | Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a request carrying many su… |
CVE-2026-111809 | Critical | 9.3 | 2026-10-21 | Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding. This issue affects Apache Traffic Server: f… |
CVE-2026-111808 | High | 8.6 | 2026-10-21 | Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame. This issue affects Apache Traffic Se… |
CVE-2026-111805 | High | 8.6 | 2026-10-21 | Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value. This issue affects Apache Traffic… |
CVE-2026-111816 | Critical | 9.3 | 2026-10-21 | Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out bypa… |
CVE-2026-111813 | Critical | 10.0 | 2026-10-21 | Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) configuration… |
CVE-2026-111804 | High | 8.2 | 2026-10-21 | Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to th… |
CVE-2026-105945 | | 2026-10-21 | The Pulsar Packages Management Service can be configured to store packages on the local filesystem of the broker by using the filesystem storage provider. Pack… | |
CVE-2026-105944 | | 2026-10-21 | Apache Pulsar Manager is a web console for administering Apache Pulsar clusters. It has its own user accounts and login, and it can be configured with an HTTP… | |
CVE-2026-105942 | | 2026-10-21 | When a configured proxy role sends a request to the broker on behalf of another user (the original principal), the broker is designed to authorize both the pro… | |
CVE-2026-105938 | | 2026-10-21 | Apache Pulsar namespaces can restrict which roles may use a subscription, either with the Prefix subscription authentication mode, which requires a subscriptio… | |
CVE-2026-105937 | | 2026-10-21 | Apache Pulsar shadow topics (PIP-180) are topics that read the stored messages of a source topic from that topic's managed ledger. The source topic is selected… | |
CVE-2026-105936 | | 2026-10-21 | The Pulsar Functions worker REST API provides two endpoints that return the catalog of Pulsar IO connectors installed on the functions worker: the worker conne… | |
CVE-2026-105935 | | 2026-10-21 | The Pulsar Functions Worker provides a REST API endpoint for triggering a function, which publishes a caller-supplied value to one of the function's configured… | |
CVE-2026-105934 | | 2026-10-21 | The Apache Pulsar broker admin REST API provides a truncate operation for persistent topics (DELETE /admin/v2/persistent/{tenant}/{namespace}/{topic}/truncate)… | |
CVE-2026-105933 | | 2026-10-21 | Apache Pulsar allows an administrator to require end-to-end message encryption for all topics in a namespace by setting the encryption_required namespace polic… | |
CVE-2026-105932 | | 2026-10-21 | The Apache Pulsar broker admin REST API provides endpoints to read, set and remove the topic-level entry filter policy of a topic. For persistent topics these… | |
CVE-2026-105931 | | 2026-10-21 | The Apache Pulsar broker exposes a transaction administration REST API under /admin/v3/transactions. When authentication and authorization are enabled, most of… | |
CVE-2025-55702 | High | 8.7 | 2026-10-21 | When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the c… |
CVE-2025-31699 | High | 8.9 | 2026-10-21 | Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never full… |
CVE-2026-105930 | | 2026-10-21 | When package management is enabled, Pulsar Functions, Sources and Sinks can be registered or updated from a package stored in the Pulsar Packages Management Se… | |
CVE-2026-105927 | | 2026-10-21 | The Apache Pulsar WebSocket service allows a WebSocket consumer to configure a dead letter policy through query parameters of the consumer endpoint, including… | |
CVE-2026-105926 | | 2026-10-21 | The Pulsar broker serves two schema commands on its binary protocol: GetSchema, which returns the schema registered for a topic, and GetOrCreateSchema, which r… | |
CVE-2026-105869 | | 2026-10-21 | Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token (JWT). The provider is intended… | |
CVE-2026-90484 | | 2026-10-21 | The MySQL client response parser in Apache bRPC dereferences a null pointer when the server peer sends a zero-payload-length response packet. A response packet… | |
CVE-2026-87849 | | 2026-10-21 | The Discovery naming-service reply parser in Apache bRPC (versions < 1.18.0) calls RapidJSON object-only accessors (FindMember) on JSON values without first va… | |
CVE-2026-86249 | | 2026-10-21 | On a brpc::Server that sets both ServerOptions.auth and ServerOptions.internal_port, the HTTP built-in service exemption on internal_port can be abused to bypa… | |
CVE-2026-86147 | | 2026-10-21 | External control of file name or path and uncontrolled resource consumption in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers who can… | |
CVE-2026-86146 | | 2026-10-21 | Inconsistent interpretation of HTTP requests (HTTP request/response smuggling) in the bundled HTTP/1.1 parser of Apache bRPC (version < 1.18.0) on all platform… | |
CVE-2026-84748 | | 2026-10-21 | Improper authorization in Apache bRPC (versions < 1.18.0) on all platforms allows remote attackers to access builtin services through the public port. Root Ca… | |
CVE-2026-84747 | | 2026-10-21 | Interpretation conflict in the HTTP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to bypass access control… | |
CVE-2026-84727 | Medium | 5.4 | 2026-10-21 | Use-after-free in the RTMP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows a malicious RTMP peer to crash the process or pote… |
CVE-2026-82953 | | 2026-10-21 | NULL pointer dereference in the RTMP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to crash the server (de… | |
CVE-2026-82942 | | 2026-10-21 | A data race in the RDMA transport of Apache bRPC (versions < 1.18.0) allows a remote client to crash the server process (denial of service) when RDMA is enable… | |
CVE-2026-82425 | | 2026-10-21 | A reachable assertion in Apache bRPC (version < 1.18.0) on all platforms allows a malicious remote peer to crash the process, resulting in denial of service. … | |
CVE-2026-82231 | | 2026-10-21 | A Thrift client in Apache bRPC (version < 1.18.0, built with WITH_THRIFT which is off by default) can be crashed by the server peer it talks to. When the serve… | |
CVE-2026-82230 | High | 7.5 | 2026-10-21 | Uncontrolled recursion in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server crash via sendi… |
CVE-2026-82210 | | 2026-10-21 | Enforceable assertion in the streaming feature of Apache bRPC (version < 1.18.0) on all platforms allows a remote attacker to crash the server process by sendi… | |
CVE-2026-81755 | | 2026-10-21 | Uncontrolled resource consumption in the streaming RPC component of Apache bRPC (version < 1.18.0) allows a remote attacker to exhaust server memory and cause… | |
CVE-2026-80463 | | 2026-10-21 | Unbounded memory accumulation in the stream message reassembly path of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to exhaust the m… | |
CVE-2026-79704 | | 2026-10-21 | An out-of-bounds read vulnerability exists in the streaming RPC client of Apache bRPC (versions 1.11.0 through 1.17.0) on all platforms. A client that creates… | |
CVE-2026-78334 | | 2026-10-21 | Missing authentication in the streaming RPC path of Apache bRPC (version < 1.18.0) on all platforms allows a remote attacker to bypass server authentication an… | |
CVE-2026-78066 | | 2026-10-21 | Resource exhaustion in Apache bRPC (version < 1.18.0) on all platforms: multiple parsers that accept wire-controlled input bound no limit on the sizes declared… | |
CVE-2026-78058 | | 2026-10-21 | Uncontrolled resource consumption in the HTTP/2 (h2) receive path of Apache bRPC (version < 1.18.0) on all platforms allows a remote unauthenticated attacker t… | |
CVE-2026-78048 | | 2026-10-21 | A reachable-assertion flaw in the HPACK header-compression decoder of the HTTP/2 (h2/gRPC) stack in Apache bRPC (version < 1.18.0) on all platforms allows a re… | |
CVE-2026-74758 | | 2026-10-21 | A heap use-after-free in the RTMP protocol component of Apache bRPC (versions < 1.18.0) allows a remote attacker to crash a bRPC RTMP server by sending a craft… | |
CVE-2026-74757 | | 2026-10-21 | Uncontrolled resource allocation in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server alloc… | |
CVE-2026-74755 | | 2026-10-21 | An integer underflow in the mcpack2pb component of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to crash a bRPC server by sending a… | |
CVE-2026-66392 | | 2026-10-21 | Apache bRPC versions before 1.18.0 validate the server certificate chain when client TLS peer verification is enabled, but do not bind the certificate to an ex… | |
CVE-2026-61916 | | 2026-10-21 | Out-of-bounds reads in URL parsing and case-insensitive header lookup in Apache bRPC before version 1.18.0 on platforms where plain char is unsigned, such as A… | |
CVE-2026-61902 | | 2026-10-21 | Apache bRPC versions before 1.18.0 do not consistently enforce the configured max_body_size limit in non-progressive HTTP/1 and HTTP/2 parsing and in memcache… | |
CVE-2026-59562 | | 2026-10-21 | Missing authentication for critical function vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 2.0.0 before 2.0.11. Users are recommen… | |
CVE-2026-59229 | | 2026-10-21 | The Legacy Pipe receiver protocol (handshake / sendPipeData) uses a hardcoded SUPER_USER (root) identity when executing data loading and deletion operations. A… | |
CVE-2026-58064 | | 2026-10-21 | The Redis protocol implementation in Apache bRPC allowed inline command parsing to allocate and copy the full connection buffer before a complete CRLF-terminat… | |
CVE-2026-56388 | | 2026-10-21 | The Redis server command parser in Apache bRPC accepts an empty RESP array as a command header. A remote unauthenticated attacker who can reach a bRPC server w… | |
CVE-2026-56387 | | 2026-10-21 | The RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts directly from untrusted input. A remote unauthenticated attacker who can reach a… | |
CVE-2026-56386 | High | 7.5 | 2026-10-21 | Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of ser… |
CVE-2026-54427 | | 2026-10-21 | Uncontrolled recursion in the AMF parser in Apache bRPC < 1.18.0 allows a remote RTMP peer to crash a bRPC process by sending deeply nested AMF objects or arra… | |
CVE-2026-54426 | | 2026-10-21 | Uncontrolled recursion in the Redis reply parser in Apache bRPC < 1.18.0 allows a remote Redis server peer to crash a bRPC Redis client process by returning a… | |
CVE-2026-54425 | | 2026-10-21 | Uncontrolled recursion in the HTTP/2 HPACK decoder in Apache bRPC before 1.18.0 allows remote attackers to cause denial of service by sending a crafted HTTP/2… | |
CVE-2026-48830 | | 2026-10-21 | Improper authentication in Apache bRPC through 1.17.0 allows a remote unauthenticated attacker to bypass authentication for protected non-builtin HTTP endpoint… | |
CVE-2026-58663 | | 2026-10-21 | An authentication bypass vulnerability exists in Apache IoTDB's Thrift RPC service This issue affects Apache IoTDB: from 2.0.0 before 2.0.11. Users are r… | |
CVE-2026-41114 | | 2026-10-21 | Uncontrolled Resource Consumption vulnerability in Apache IoTDB JDBC driver. This issue affects Apache IoTDB JDBC driver: from 1.3.3 before 2.0.11. Users… | |
CVE-2026-90800 | | 2026-10-20 | Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed _user or _… | |
CVE-2026-90799 | | 2026-10-20 | Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory… | |
CVE-2026-90798 | | 2026-10-20 | A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a de… | |
CVE-2026-90797 | | 2026-10-20 | An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via… | |
CVE-2026-86471 | | 2026-10-20 | An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as… | |
CVE-2026-107755 | | 2026-10-20 | Insufficient filtering of credentials in the _replicator database in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to read repli… | |
CVE-2026-93446 | | 2026-10-20 | Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently. This issue affects Apache Tomcat: from 11.0.0-M21… | |
CVE-2026-88041 | | 2026-10-20 | Incomplete cleanup vulnerability in Apache Tomcat allowed an trailer information from a previous request to leak into a subsequent request. This issue affec… | |
CVE-2026-80353 | | 2026-10-20 | Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unaut… | |
CVE-2026-74049 | | 2026-10-20 | Execution After Redirect (EAR) vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1 through 10.1… | |
CVE-2026-74048 | | 2026-10-20 | Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails… | |
CVE-2026-103119 | Critical | 9.1 | 2026-10-20 | Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current reques… |
CVE-2026-101356 | Critical | 9.1 | 2026-10-20 | Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response m… |
CVE-2026-101296 | | 2026-10-20 | A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL authentication mechanis… | |
CVE-2026-108089 | High | 7.5 | 2026-10-20 | ** UNSUPPORTED WHEN ASSIGNED ** Exposure of sensitive system information to an unauthorized control sphere vulnerability in Apache Cocoon. An unauthenticated u… |
CVE-2026-108088 | | 2026-10-20 | ** UNSUPPORTED WHEN ASSIGNED ** Use of cache containing sensitive information vulnerability in Apache Cocoon. When using the cache on a multi-user application… | |
CVE-2026-108087 | | 2026-10-20 | ** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Cocoon. This is… | |
CVE-2026-108086 | | 2026-10-20 | ** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Cocoon. This is… | |
CVE-2026-92287 | | 2026-10-20 | Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1. This affects users who read Parquet files a… | |
CVE-2026-86467 | | 2026-10-20 | Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the browser that began it. The login handle… | |
CVE-2026-88900 | High | 8.8 | 2026-10-19 | Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.1… |
CVE-2026-91858 | Medium | 6.5 | 2026-10-19 | FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through TransformerFactory.newInstance() and enabl… |
CVE-2026-88901 | High | 8.2 | 2026-10-19 | Improper Restriction of XML External Entity Reference vulnerability in Apache Camel. This issue affects Apache Camel: from 4.7.0 before 4.18.5, from 4.19.0… |
CVE-2026-85317 | Medium | 4.8 | 2026-10-19 | Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4… |
CVE-2026-85316 | Medium | 4.8 | 2026-10-19 | Insufficient Granularity of Access Control vulnerability in Apache Camel Platform HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, f… |
CVE-2026-85315 | Medium | 5.3 | 2026-10-19 | Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel gRPC component. This issue affects Apache Camel: from 4.0.0 before… |
CVE-2026-85314 | Medium | 6.5 | 2026-10-19 | Improper Input Validation vulnerability in Apache Camel Mail component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. … |
CVE-2026-85313 | Medium | 4.3 | 2026-10-19 | Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Jetty component. This issue affects Apache Camel: from 4.0.0 before 4.18.5… |
CVE-2026-85312 | Medium | 4.8 | 2026-10-19 | Improper Input Validation vulnerability in Apache Camel Core component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. … |