Apache vulnerabilities
We track 1,499 vulnerabilities in Apache products across 60+ products. 1,499 are rated high or critical, and 46 have been exploited in real attacks. The most recent was published on November 13, 2026.
Latest Apache vulnerabilities
- 7.5 High severity
Apache Traffic Server: Improper Check for Unusual or Exceptional Conditions
Improper Check for Unusual or Exceptional Conditions vulnerability handling requests in Apache Traffic Server allows an attacker to crash the server under certain conditions. This issue affects Apache Traffic Server: from 8.0.0 through 9.1.3.
- 8.8 High severity
Apache Atlas: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability in import module of Apache Atlas allows an authenticated user to write to web server filesystem. This issue affects Apache Atlas versions from 0.8.4 to 2.2.0.
- 9.8 Critical severity
Apache CXF: Server-Side Request Forgery
A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type.
- 7.5 High severity
A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a…
A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. The vulnerability only applies when the CXFServlet is configured with both the static-resources-list and redirect-quer
- 9.8 Critical severity
Apache Tapestry: Deserialization of Untrusted Data
Apache Tapestry 3.x allows deserialization of untrusted data, leading to remote code execution. This issue is similar to but distinct from CVE-2020-17531, which applies the the (also unsupported) 4.x version line. NOTE: This vulnerability only affects Apache T
- 8.8 High severity
Apache Fineract: Improper Limitation of a Pathname to a Restricted Directory
Apache Fineract allowed an authenticated user to perform remote code execution due to a path traversal vulnerability in a file upload component of Apache Fineract, allowing an attacker to run remote code. This issue affects Apache Fineract version 1.8.0 and pr
- 9.8 Critical severity
Apache DolphinScheduler: Improper Neutralization of Special Elements used in a Command
Alarm instance management has command injection when there is a specific command configured. It is only for logged-in users. We recommend you upgrade to version 2.0.6 or higher
- 7.8 High severity
Apache Airflow Hive Provider: Improper Neutralization of Special Elements used in an OS Command
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Hive Provider, Apache Airflow allows an attacker to execute arbtrary commands in the task execution context, without write access to DAG
- 9.8 Critical severity
Apache Airlfow Pig Provider: Improper Neutralization of Special Elements used in an OS Command
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pig Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG f
- 9.8 Critical severity
Apache Airflow Pinot Provider: Improper Neutralization of Special Elements used in an OS Command
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pinot Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG
- 7.5 High severity
missing input validation in Apache Hama may cause information disclosure through path…
missing input validation in Apache Hama may cause information disclosure through path traversal and XSS. Since Apache Hama is EOL, we do not expect these issues to be fixed.
- 9.8 Critical severity
Apache MINA SSHD: Deserialization of Untrusted Data
Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The class is one of several implementations that an implementor using Apache MINA SSHD
- 9.8 Critical severity
Apache Jena SDB: Deserialization of Untrusted Data
Apache Jena SDB 3.17.0 and earlier is vulnerable to a JDBC Deserialisation attack if the attacker is able to control the JDBC URL used or cause the underlying database server to return malicious data. The mySQL JDBC driver in particular is known to be vulnerab
- 9.8 Critical severity
Apache SOAP: Missing Authentication for Critical Functionality
In the default configuration of Apache SOAP, an RPCRouterServlet is available without authentication. This gives an attacker the possibility to invoke methods on the classpath that meet certain criteria. Depending on what classes are available on the classpath
- 8.8 High severity
Apache Airflow: Improper Control of Generation of Code
A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided run_id parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0.
- 7.5 High severity
Apache Airflow: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability in UI of Apache Airflow allows an attacker to view unmasked secrets in rendered template values for tasks which were not executed (for example when they were depending on past and previous instances of the task failed). This issue affects Apach
- 7.5 High severity
Apache Ivy: Improper Limitation of a Pathname to a Restricted Directory
When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a user-supplied "pattern" that may include placeholders for artifacts coordinates like the organisation, module or version. If said coordinates contain "../"
- 9.8 Critical severity
Apache Commons BCEL: Out-of-bounds Write
Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pas
- 9.1 Critical severity
Apache Ivy: Improper Limitation of a Pathname to a Restricted Directory
With Apache Ivy 2.4.0 an optional packaging attribute has been introduced that allows artifacts to be unpacked on the fly if they used pack200 or zip packaging. For artifacts using the "zip", "jar" or "war" packaging Ivy prior to 2.5.1 doesn't verify the targe
- 8.1 High severity
Apache Pulsar: Improper Certificate Validation
The Apache Pulsar C++ Client does not verify peer TLS certificates when making HTTPS calls for the OAuth2.0 Client Credential Flow, even when tlsAllowInsecureConnection is disabled via configuration. This vulnerability allows an attacker to perform a man in th
- 7.5 High severity
Apache UIMA: Improper Limitation of a Pathname to a Restricted Directory
A relative path traversal vulnerability in a FileUtil class used by the PEAR management component of Apache UIMA allows an attacker to create files outside the designated target directory using carefully crafted ZIP entry names. This issue affects Apache UIMA
- 7.5 High severity
Apache Tomcat: Inconsistent Interpretation of HTTP Requests
If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a request containing an
- 7.5 High severity
Apache IoTDB: Uncontrolled Resource Consumption
Apache IoTDB version 0.12.2 to 0.12.6, 0.13.0 to 0.13.2 are vulnerable to a Denial of Service attack when accepting untrusted patterns for REGEXP queries with Java 8. Users should upgrade to 0.13.3 which addresses this issue or use a later version of Java to a
- 9.8 Critical severity
Apache Flume versions 1.4.0 through 1.10.1 are vulnerable to a remote code execution (RCE)…
Apache Flume versions 1.4.0 through 1.10.1 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol.
- 8.8 High severity
Apache Linkis: Deserialization of Untrusted Data
In Apache Linkis <=1.2.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact exists when an attacker has write access to a database and configures a JDBC EC with a MySQL data source and malicious par
- 7.5 High severity
Apache XML Graphics: Server-Side Request Forgery
A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue affects Apache XML Graphics prior to 1.16. Users are recommended to upgrade to version 1.16.
- 7.5 High severity
Apache XML Graphics: Server-Side Request Forgery
A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. This issue affects Apache XML Graphics prior to 1.16. It is recommended to update to version 1.16.
- 9.8 Critical severity
Apache Dubbo: Deserialization of Untrusted Data
A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.17 and prior versions; Apache Dubbo 3.0.x version 3.0.11 and prior ve
- 9.8 Critical severity
Apache Commons Text: Improper Control of Generation of Code
Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringL
- 9.8 Critical severity
Apache Kylin: Improper Neutralization of Special Elements used in an OS Command
Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the configuration overwrites menu. RCE can be implemented by closing the single quotation marks around the parameter value of “-- conf=” to inject any op
- 8.1 High severity
In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already…
In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API.
- 9.8 Critical severity
Apache Pinot: Improper Control of Generation of Code
In 0.10.0 or older versions of Apache Pinot, Pinot query endpoint and realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support. In order to avoid this, we disabled the groovy function support by default from Pin
- 7.5 High severity
Apache XML Graphics: Server-Side Request Forgery
Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files using a Jar url. This issue affects Apache XML Graphics Batik 1.14.
- 7.5 High severity
Apache SOAP: Improper Restriction of XML External Entity Reference
An Improper Restriction of XML External Entity Reference vulnerability in RPCRouterServlet of Apache SOAP allows an attacker to read arbitrary files over HTTP. This issue affects Apache SOAP version 2.2 and later versions. It is unknown whether previous versio
- 8.8 High severity
Apache InLong: Deserialization of Untrusted Data
In versions of Apache InLong prior to 1.3.0, an attacker with sufficient privileges to specify MySQL JDBC connection URL parameters and to write arbitrary data to the MySQL database, could cause this data to be deserialized by Apache InLong, potentially leadin
- 7.5 High severity
Apache Kafka: Allocation of Resources Without Limits or Throttling
A security vulnerability has been identified in Apache Kafka. It affects all releases since 2.8.0. The vulnerability allows malicious unauthenticated clients to allocate large amounts of memory on brokers. This can lead to brokers hitting OutOfMemoryException
- 9.8 Critical severity
Apache Calcite: Improper Restriction of XML External Entity Reference
Apache Calcite 1.22.0 introduced the SQL operators EXISTS_NODE, EXTRACT_XML, XML_TRANSFORM and EXTRACT_VALUE do not restrict XML External Entity references in their configuration, making them vulnerable to a potential XML External Entity (XXE) attack. Therefor
- 7.5 High severity
Apache James: Improper Neutralization of Special Elements used in a Command
Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. Fix of CVE-2021-38542, which solved similar problem fron Apache James 3.6.1, is subject to a parser differential and do not take into
- 7.5 High severity
Apache IoTDB: Missing Authorization
Apache IoTDB grafana-connector version 0.13.0 contains an interface without authorization, which may expose the internal structure of database. Users should upgrade to version 0.13.1 which addresses this issue.
- 7.5 High severity
Apache OFBiz: Inefficient Regular Expression Complexity
Apache OFBiz up to version 18.12.05 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles URLs provided by external, unauthenticated users. Upgrade to 18.12.06 or apply patches at https://issues.apache.org/jira/browse/OFBIZ-12599