Apache Apisix
29 CVEs affecting Apache Apisix. Latest disclosed: 2026-08-27. Critical: 7, High: 14.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-25757 | Critical | 9.8 | 2022-03-28 | In Apache APISIX before 2.13.0, when decoding JSON with duplicate keys, lua-cjson will choose the last occurred value as the result. By passing a JSON with a d… |
CVE-2022-24112 | Critical | 9.8 | 2022-02-11 | An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with defa… |
CVE-2026-49871 | Critical | 9.3 | 2026-06-19 | Cross-Site Request Forgery (CSRF) vulnerability in the cas-auth plugin under default configurations. This defect allows a remote attacker that manages to send… |
CVE-2026-49230 | Critical | 9.1 | 2026-06-19 | Improper Validation of Integrity Check Value vulnerability in Apache APISIX. The jwe-decrypt plugin under default configuration is vulnerable to authenticatio… |
CVE-2026-44087 | Critical | 9.1 | 2026-06-19 | Insufficient Verification of Data Authenticity vulnerability in Apache APISIX. The openid-connect plugin under default configuration has an attack surface tha… |
CVE-2026-39999 | Critical | 9.1 | 2026-06-19 | Authentication Bypass by Spoofing vulnerability in Apache APISIX. The attacker can completely bypass authentication capitalising on certain configurations of… |
CVE-2026-31908 | Critical | 9.1 | 2026-04-14 | Header injection vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in forward-auth plugin to inject malicious headers. … |
CVE-2026-63041 | High | 8.8 | 2026-08-26 | Reliance on Untrusted Inputs in a Security Decision vulnerability in Apache APISIX. This vulnerability allows an attacker to escalate privilege or perform an… |
CVE-2026-39998 | High | 8.8 | 2026-06-19 | Improper Input Validation vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in forward-auth plugin to spoof identity he… |
CVE-2026-75020 | High | 8.1 | 2026-08-27 | Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache APISIX. A caller who holds valid credentials for… |
CVE-2026-49872 | High | 8.1 | 2026-06-19 | Improper Authentication vulnerability in Apache APISIX. When the cas-auth plugin is used in a route, an attacker can possibly authenticate itself with credent… |
CVE-2026-47339 | High | 8.1 | 2026-06-19 | Incorrect Authorization vulnerability in Apache APISIX. An attacker can capitalise on authz-casdoor plugin under default configuration to authenticate themsel… |
CVE-2025-27446 | High | 7.8 | 2025-07-06 | Incorrect Permission Assignment for Critical Resource vulnerability in Apache APISIX(java-plugin-runner). Local listening file permissions in APISIX plugin ru… |
CVE-2026-75005 | High | 7.5 | 2026-08-27 | Inefficient Algorithmic Complexity vulnerability in Apache APISIX. A single small request can pin a gateway worker at 100% CPU for an extended period in grap… |
CVE-2026-74848 | High | 7.5 | 2026-08-27 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache APISIX. An attacker could make other clients receive… |
CVE-2026-31923 | High | 7.5 | 2026-04-14 | Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. This can occur due to `ssl_verify` in openid-connect plugin configuration bein… |
CVE-2025-62232 | High | 7.5 | 2025-10-31 | Sensitive data exposure via logging in basic-auth leads to plaintext usernames and passwords written to error logs and forwarded to log sinks when log level is… |
CVE-2023-44487 | High | 7.5 | 2023-10-10 | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the w… |
CVE-2022-29266 | High | 7.5 | 2022-04-20 | In APache APISIX before 3.13.1, the jwt-auth plugin has a security issue that leaks the user's secret key because the error message returned from the dependenc… |
CVE-2021-43557 | High | 7.5 | 2021-11-22 | The uri-block plugin in Apache APISIX before 2.10.2 uses $request_uri without verification. The $request_uri is the full original request URI without normaliza… |