Apache Calcite Avatica vulnerabilities

2 known vulnerabilities in Apache Calcite Avatica from Apache. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  Apache Calcite Avatica: Use of Externally-Controlled Input to Select Classes or Code

  CVE-2026-70410Sep 22, 2026Apache

  Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Calcite Avatica. Plugin instantiation (via AvaticaUtils#instantiatePlugin and other methods) initializes arbitrary classes via unrestricted calls to Clas

• 8.8 High severity

  Apache Calcite Avatica: Improper Initialization

  CVE-2022-36364Jul 28, 2022ApacheEPSS 3.16%

  Apache Calcite Avatica JDBC driver creates HTTP client instances based on class names provided via `httpclient_impl` connection property; however, the driver does not verify if the class implements the expected interface before instantiating it, which can lead