Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.apache.tapestry:tapestry-core

10 known vulnerabilities (1 critical, 1 high), with the versions each affects and the releases that fix them.

Latest release
5.9.2 (Oct 28, 2026): no advisory affects it
Newest unaffected release
5.9.2 (Oct 28, 2026), the latest release
Advisories
10 · 1 critical, 1 high
Releases
77 since 5.0.1 (Feb 2, 2007)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 10

  • Apache Tapestry: Possible classpath file download through URL manipulation

    Affected: from 5.5.0, fixed in 5.9.1.

    Fixed in 5.9.1 (released Apr 7, 2026, 125 days before disclosure).

    The latest release, 5.9.2, is not affected.

  • CVE-2022-46366Critical 9.8

    Apache Tapestry prior to version 4 (EOL) allows RCE though deserialization of untrusted input

    Affected: from 3.0, fixed in 5.0.1.

    Fixed in 5.0.1 (released Feb 2, 2007, 5782 days before disclosure).

    The latest release, 5.9.2, is not affected.

  • Regular Expression Denial of Service (ReDoS) in ContentType.java. (GHSL-2022-022)

    Affected: fixed in 5.8.2.

    Fixed in 5.8.2 (released Jun 15, 2022, 28 days before disclosure).

    The latest release, 5.9.2, is not affected.

  • An Information Disclosure due to insufficient input validation exists in Apache Tapestry 5.4.0 and later

    Affected: from 5.4.0, fixed in 5.6.4; from 5.7.0, fixed in 5.7.2.

    Fixed in 5.6.4 (released Apr 8, 2021, 19 days before disclosure) and 5.7.2 (released Apr 8, 2021, 19 days before disclosure).

    The latest release, 5.9.2, is not affected.

  • Bypass of the fix for CVE-2019-0195

    Affected: from 5.4.0, fixed in 5.6.3; from 5.7.0, fixed in 5.7.1.

    Fixed in 5.6.3 (released Mar 9, 2021, 37 days before disclosure) and 5.7.1 (released Mar 9, 2021, 37 days before disclosure).

    The latest release, 5.9.2, is not affected.

  • In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-INF folder of the WAR being…

    Affected: from 5.4.0, fixed in 5.6.0.

    Fixed in 5.6.0 (released Aug 23, 2020, 38 days before disclosure).

    The latest release, 5.9.2, is not affected.

  • The code which checks HMAC in form submissions used String.equals() for comparisons, which results in a timing side channel for the…

    Affected: from 5.4, fixed in 5.4.5.

    Fixed in 5.4.5 (released Sep 3, 2019, 13 days before disclosure).

    The latest release, 5.9.2, is not affected.

  • Tapestry processes assets `/assets/ctx` using classes chain `StaticFilesFilter -> AssetDispatcher -> ContextResource`, which doesn't…

    Affected: from 5.4.0, fixed in 5.4.5.

    Fixed in 5.4.5 (released Sep 3, 2019, 13 days before disclosure).

    The latest release, 5.9.2, is not affected.

  • Manipulating classpath asset file URLs, an attacker could guess the path to a known file in the classpath and have it downloaded.

    Affected: from 5.4.0, fixed in 5.4.5.

    Fixed in 5.4.5 (released Sep 3, 2019, 13 days before disclosure).

    The latest release, 5.9.2, is not affected.

  • Apache Tapestry before 5.3.6 relies on client-side object storage without checking whether a client has modified an object, which allows…

    Affected: fixed in 5.3.6.

    Fixed in 5.3.6 (released Oct 9, 2012, 1047 days before disclosure).

    The latest release, 5.9.2, is not affected.