Apache vulnerabilities
3,063 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-78058Apache bRPC: Unbounded Resource Consumption and Crash in the HTTP/2 Receive Path
- CVE-2026-78048Apache bRPC: Remote Denial of Service via Out-of-Bounds Dynamic Table Sizing in HPACK Decoder
- CVE-2026-74758Apache bRPC: Heap Use-After-Free in RTMP Abort Message Handling
- CVE-2026-74757Apache bRPC: Uncontrolled Memory Allocation via Malicious mcpack Array Item Count
- CVE-2026-74755Apache bRPC: Integer Underflow in mcpack2pb Parser Leading to Denial of Service
- CVE-2026-66392Apache bRPC: TLS Client Accepts Certificates for Mismatched Peer Names
- CVE-2026-61916Apache bRPC: Out-of-bounds Read in URL and Header Lookup Tables on Unsigned-char Platforms
- CVE-2026-61902Apache bRPC: Memory Exhaustion Through Inconsistent Message Body Limits
- CVE-2026-58064Apache bRPC: Denial of Service via Unbounded Redis Inline Command Allocation
- CVE-2026-56388Apache bRPC: Out-of-Bounds Write in Redis Command Parser
- CVE-2026-56387Apache bRPC: Remote Memory Exhaustion in RTMP AMF Parser
- CVE-2026-56386Apache bRPC: Integer Underflow and Out-of-Bounds Read in HTTP/2 DATA Frame Parser
- CVE-2026-54427Apache bRPC: Stack Exhaustion via Unbounded Recursion in AMF Parser
- CVE-2026-54426Apache bRPC: Stack Exhaustion via Unbounded Recursion in Redis Reply Parser
- CVE-2026-54425Apache bRPC: Stack Exhaustion via Recursive HPACK Dynamic Table Size Update Decoding
- CVE-2026-48830Apache bRPC: HTTP builtin request can mark a connection authenticated and bypass auth for later requests
- CVE-2026-59229Apache IoTDB: Legacy Pipe Privilege Escalation
- CVE-2026-59562Apache IoTDB: Remote code execution and Unauthenticated path traversal in legacy pipe sendFile RPC
- CVE-2026-41114Apache IoTDB JDBC driver: Large-scale Memory Exhaustion via BigDecimal toPlainString in JDBC Driver
- CVE-2026-58663Apache IoTDB: Auth Bypass in pipeTransfer() interface
- CVE-2026-107755Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLs
- CVE-2026-90800Apache CouchDB: Auth bypass in prefixed _users and _replicator databases
- CVE-2026-90799Apache CouchDB: Atom-table exhaustion in _changes sequences and _search bookmarks with specially crafted sequence values
- CVE-2026-90798Apache CouchDB: Replicator follows redirects indefinitely
- CVE-2026-90797Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session
- CVE-2026-86471Apache CouchDB: Admin credentials leading to code execution as operating system user
- CVE-2026-103119Apache Tomcat: AJP response mix-up
- CVE-2026-101356Apache Tomcat: HTTP/2 request/response mix-up after error during async processing
- CVE-2026-101296Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms
- CVE-2026-93446Apache Tomcat: Possible TLS 1.3 connection failures