Apache Tapestry vulnerabilities

3 known vulnerabilities in Apache Tapestry from Apache. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Apache Tapestry: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2026-61899Aug 10, 2026Apache

  Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue.

• 9.8 Critical severity

  Apache Tapestry: Deserialization of Untrusted Data

  CVE-2022-46366Dec 2, 2022ApacheEPSS 3.67%

  Apache Tapestry 3.x allows deserialization of untrusted data, leading to remote code execution. This issue is similar to but distinct from CVE-2020-17531, which applies the the (also unsupported) 4.x version line. NOTE: This vulnerability only affects Apache T

• 7.5 High severity

  Apache Tapestry: Inefficient Regular Expression Complexity

  CVE-2022-31781Jul 13, 2022ApacheEPSS 1.97%

  Apache Tapestry up to version 5.8.1 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles Content Types. Specially crafted Content Types may cause catastrophic backtracking, taking exponential time to complete. Specifically, this