Apache Apache Guacamole
8 CVEs affecting Apache Apache Guacamole. Latest disclosed: 2025-07-02. Critical: 0, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-43999 | High | 8.8 | 2022-01-11 | Apache Guacamole 1.2.0 and 1.3.0 do not properly validate responses received from a SAML identity provider. If SAML support is enabled, this may allow a malici… |
CVE-2017-3158 | High | 8.1 | 2018-01-18 | A race condition in Guacamole's terminal emulator in versions 0.9.5 through 0.9.10-incubating could allow writes of blocks of printed data to overlap. Such ove… |
CVE-2023-43826 | High | 7.5 | 2023-12-19 | Apache Guacamole 1.5.3 and older do not consistently ensure that values received from a VNC server will not result in integer overflow. If a user connects to a… |
CVE-2018-1340 | High | 7.5 | 2019-02-07 | Prior to 1.0.0, Apache Guacamole used a cookie for client-side storage of the user's session token. This cookie lacked the "secure" flag, which could allow an… |
CVE-2024-35164 | Medium | 6.8 | 2025-07-02 | The terminal emulator of Apache Guacamole 1.5.5 and older does not properly validate console codes received from servers via text-based protocols like SSH. If… |
CVE-2023-30576 | Medium | 6.8 | 2023-06-07 | Apache Guacamole 0.9.10 through 1.5.1 may continue to reference a freed RDP audio input buffer. Depending on timing, this may allow an attacker to execute arbi… |
CVE-2023-30575 | Medium | 6.5 | 2023-06-07 | Apache Guacamole 1.5.1 and older may incorrectly calculate the lengths of instruction elements sent during the Guacamole protocol handshake, potentially allowi… |
CVE-2021-41767 | Medium | 6.5 | 2022-01-11 | Apache Guacamole 1.3.0 and older may incorrectly include a private tunnel identifier in the non-private details of some REST responses. This may allow an authe… |