Apache vulnerabilities
We track 1,499 vulnerabilities in Apache products across 60+ products. 1,499 are rated high or critical, and 46 have been exploited in real attacks. The most recent was published on November 13, 2026.
Latest Apache vulnerabilities
- 7.5 High severity
Apache Tomcat: Uncontrolled Resource Consumption
The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the
- 9.8 Critical severity
Apache Jena: Improper Restriction of XML External Entity Reference
A vulnerability in the RDF/XML parser of Apache Jena allows an attacker to cause an external DTD to be retrieved. This issue affects Apache Jena version 4.4.0 and prior versions. Apache Jena 4.2.x and 4.3.x do not allow external entities.
- 7.5 High severity
Apache NiFi: Improper Restriction of XML External Entity Reference
Multiple components in Apache NiFi 0.0.1 to 1.16.0 do not restrict XML External Entity references in the default configuration. The Standard Content Viewer service attempts to resolve XML External Entity references when viewing formatted XML files. The followi
- 9.8 Critical severity
Apache CouchDB Insecure Default Initialization of Resource Exploited
In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including rec
- 7.5 High severity
Apache APISIX: Generation of Error Message Containing Sensitive Information
In APache APISIX before 3.13.1, the jwt-auth plugin has a security issue that leaks the user's secret key because the error message returned from the dependency lua-resty-jwt contains sensitive information.
- 9.8 Critical severity
Apache Superset: Improper Neutralization of Special Elements used in an SQL Command
Apache Superset before 1.4.2 is vulnerable to SQL injection in chart data requests. Users should update to 1.4.2 or higher which addresses this issue.
- 7.5 High severity
Apache Subversion: Use After Free
Subversion's mod_dav_svn is vulnerable to memory corruption. While looking up path-based authorization rules, mod_dav_svn servers may attempt to use memory which has already been freed. Affected Subversion mod_dav_svn servers 1.10.0 through 1.14.1 (inclusive).
- 9.8 Critical severity
Apache Hadoop: Improper Link Resolution Before File Access
In Apache Hadoop, The unTar function uses unTarUsingJava function on Windows and the built-in tar utility on Unix and other OSes. As a result, a TAR entry may create a symlink under the expected extraction directory which points to an external directory. A sub
- 7.5 High severity
Apache Pinot: Uncontrolled Recursion
In 0.9.3 or older versions of Apache Pinot segment upload path allowed segment directories to be imported into pinot tables. In pinot installations that allow open access to the controller a specially crafted request can potentially be exploited to cause disru
- 7.5 High severity
Apache DolphinScheduler: Inefficient Regular Expression Complexity
Apache DolphinScheduler user registration is vulnerable to Regular express Denial of Service (ReDoS) attacks, Apache DolphinScheduler users should upgrade to version 2.0.5 or higher.
- 9.8 Critical severity
In Apache APISIX before 2.13.0, when decoding JSON with duplicate keys, lua-cjson will choose…
In Apache APISIX before 2.13.0, when decoding JSON with duplicate keys, lua-cjson will choose the last occurred value as the result. By passing a JSON with a duplicate key, the attacker can bypass the body_schema validation in the request-validation plugin. Fo
- 7.5 High severity
Apache CloudStack: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Apache CloudStack prior to 4.16.1.0 used insecure random number generation for project invitation tokens. If a project invite is created based only on an email address, a random token is generated. An attacker with knowledge of the project ID and the fact that
- 9.8 Critical severity
Apache HTTP Server: Out-of-bounds Write
Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with possibly attacker provided data. This issue affects Apache HTTP Server 2.4 version 2.4.52 and prior versions.
- 9.1 Critical severity
Apache HTTP Server: Integer Overflow or Wraparound
If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and earlier.
- 9.8 Critical severity
Apache HTTP Server: Inconsistent Interpretation of HTTP Requests
Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling
- 7.5 High severity
Apache HTTP Server: Improper Initialization
A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52 and earlier.
- 9.1 Critical severity
Apache Any23: Improper Restriction of XML External Entity Reference
An XML external entity (XXE) injection vulnerability was discovered in the Any23 RDFa XSLTStylesheet extractor and is known to affect Any23 versions < 2.7. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacke
- 8.8 High severity
Apache JSPWiki: Cross-Site Request Forgery
Apache JSPWiki user preferences form is vulnerable to CSRF attacks, which can lead to account takeover. Apache JSPWiki users should upgrade to 2.11.2 or later.
- 8.8 High severity
Apache Airflow: Improper Neutralization of Special Elements used in an OS Command
In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI.
- 8.8 High severity
Apache Cayenne: Deserialization of Untrusted Data
Hessian serialization is a network protocol that supports object-based transmission. Apache Cayenne's optional Remote Object Persistence (ROP) feature is a web services-based technology that provides object persistence and query functionality to 'remote' appli
- 9.8 Critical severity
Apache APISIX Authentication Bypass Exploited
An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Ad
- 7.5 High severity
Apache Traffic Control: Server-Side Request Forgery
In Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.6, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST request to /user/login/oauth to scan a port of a server that Traffic Ops can reach.
- 7.5 High severity
Apache ActiveMQ Artemis: Allocation of Resources Without Limits or Throttling
In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability (DoS) through uncontrolled resource consumption of memory.
- 7.0 High severity
Apache Tomcat: Time-of-check Time-of-use (TOCTOU) Race Condition
The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of t
- 7.5 High severity
Apache ShenYu (incubating): Insufficiently Protected Credentials
On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users. Users are recommended to upgrade to version 2.4.2 or later.
- 8.8 High severity
Apache Log4j 1.x: Deserialization of Untrusted Data
CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.
- 9.8 Critical severity
Apache Log4j 1.x: Improper Neutralization of Special Elements used in an SQL Command
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate
- 8.8 High severity
Apache Log4j 1.x: Deserialization of Untrusted Data
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a Topi
- 9.0 Critical severity
Apache Log4j2 Deserialization of Untrusted Data Exploited
It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default
- 10.0 Critical severity
Apache Log4j2 Remote Code Execution Exploited
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who c
- 9.8 Critical severity
Apache HTTP Server Path Traversal Exploited
It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories ar
- 9.8 Critical severity
Apache HTTP Server Path Traversal Exploited
A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not
- 9.0 Critical severity
Apache HTTP Server-Side Request Forgery (SSRF) Exploited
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
- 7.8 High severity
System Information Library for Node.JS Command Injection Exploited
The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerabilit
- 7.5 High severity
Apache Flink Improper Access Control Exploited
A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible by
- 9.8 Critical severity
Apache Struts Remote Code Execution Exploited
Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.
- 9.8 Critical severity
Apache Airflow's Experimental API Authentication Bypass Exploited
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and i
- 8.8 High severity
Apache Airflow Command Injection Exploited
An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running
- 8.8 High severity
Apache Kylin OS Command Injection Exploited
Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.
- 9.8 Critical severity
Apache Tomcat Improper Privilege Management Exploited
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attac