Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.apache.druid:druid

8 known vulnerabilities (1 critical, 2 medium), with the versions each affects and the releases that fix them.

Latest release
38.0.0 (Sep 24, 2026): no advisory affects it
Newest unaffected release
38.0.0 (Sep 24, 2026), the latest release
Advisories
8 · 1 critical, 2 medium
Dependents
0
Releases
45 since 0.13.0-incubating (Dec 2, 2018)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

  • CVE-2025-59390
    Affects 0.13.0-incubating to 34.0.0 (35.0.0 is outside it)
  • CVE-2025-27888
    Affects 0.13.0-incubating to 31.0.1 (31.0.2 is outside it); 32.0.0 (32.0.1 is outside it)
  • CVE-2024-45537
    Affects 0.13.0-incubating to 30.0.0 (30.0.1 is outside it)
  • CVE-2022-28889
    Affects 0.13.0-incubating to 0.22.1 (0.23.0 is outside it)
  • CVE-2021-44791
    Affects 0.13.0-incubating to 0.22.1 (0.23.0 is outside it)
  • CVE-2021-26919
    Affects 0.13.0-incubating to 0.20.1 (0.20.2 is outside it)
  • CVE-2021-25646
    Affects 0.13.0-incubating to 0.20.0 (0.20.1 is outside it)
  • CVE-2020-1958
    Affects 0.17.0 (0.17.1 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 8

  • CVE-2025-59390Critical 9.8

    Apache Druid: Kerberos authenticaton chooses a cryptographically unsecure secret if not configured explicitly.

    Affected: fixed in 35.0.0.

    Fixed in 35.0.0 (released Oct 28, 2025, 29 days before disclosure).

    The latest release, 38.0.0, is not affected.

  • CVE-2025-27888Medium 5.8

    Apache Druid: Server-Side Request Forgery and Cross-Site Scripting

    Affected: fixed in 31.0.2; fixed in 31.0.2; from 32.0.0, fixed in 32.0.1.

    Fixed in 31.0.2 (released Mar 13, 2025, 7 days before disclosure) and 32.0.1 (released Mar 13, 2025, 7 days before disclosure).

    The latest release, 38.0.0, is not affected.

  • CVE-2024-45537Medium 6.5

    Apache Druid: Users can provide MySQL JDBC properties not on allow list

    Affected: fixed in 30.0.1.

    Fixed in 30.0.1 (released Sep 8, 2024, 9 days before disclosure).

    The latest release, 38.0.0, is not affected.

  • Clickjacking in the web console

    Affected: fixed in 0.23.0.

    Fixed in 0.23.0 (released Jun 15, 2022, 22 days before disclosure).

    The latest release, 38.0.0, is not affected.

  • Reflected XSS on certain HTTP endpoints

    Affected: fixed in 0.23.0.

    Fixed in 0.23.0 (released Jun 15, 2022, 22 days before disclosure).

    The latest release, 38.0.0, is not affected.

  • Apache Druid Authenticated users can execute arbitrary code from malicious MySQL database systems.

    Affected: fixed in 0.20.2.

    Fixed in 0.20.2 (released Mar 25, 2021, 5 days before disclosure).

    The latest release, 38.0.0, is not affected.

  • Authenticated users can override system configurations in their requests which allows them to execute arbitrary code.

    Affected: fixed in 0.20.1.

    Fixed in 0.20.1 (released Jan 27, 2021, 2 days before disclosure).

    The latest release, 38.0.0, is not affected.

  • When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the…

    Affected: from 0.17.0, fixed in 0.17.1.

    Fixed in 0.17.1 (released Mar 31, 2020, 1 day before disclosure).

    The latest release, 38.0.0, is not affected.