Apache vulnerabilities
3,063 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-96292Apache Thrift: Lua `THttpTransport:_parseHeaders` matches each header line with a backtracking pattern (quadratic)
- CVE-2026-96294Apache Thrift: nodejs web server: no `error` listener on an upgraded WebSocket connection
- CVE-2026-61373Apache Thrift: Java TSaslNonblockingServer pre-auth unbounded SASL frame allocation
- CVE-2026-96990Apache Thrift: Erlang thrift_json_protocol reads a whole message with no size bound
- CVE-2026-94642Apache Thrift: PHP `TSimpleServer` exits the whole process on any non-transport exception
- CVE-2026-94644Apache Thrift: PHP `TJSONProtocol` string/number readers have no size bound
- CVE-2026-94645Apache Thrift: Node.js `TJSONProtocol` uses a peer-declared container size as an unbounded loop bound
- CVE-2026-94650Apache Thrift: c_glib generated struct readers have no recursion-depth guard (native stack exhaustion)
- CVE-2026-94651Apache Thrift: Java `TSaslNonblockingServer` `Computation.run` orphans a connection on a pre-auth parse error
- CVE-2026-85483Apache Thrift: c_glib TZlibTransport reports a full read after a premature stream end
- CVE-2026-85493Apache Thrift, Apache Thrift: TProtocolUtil.skip follows peer-chosen nesting to any depth the stack allows (Dart, Java ME)
- CVE-2026-85494Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Framed transport and binary protocol size read buffers from a peer-declared length without a limit (multi-language)
- CVE-2026-91135Apache Thrift: C++ `THeaderTransport::transform()` heap buffer overflow (write direction)
- CVE-2026-91137Apache Thrift: PHP `thrift_protocol` accelerator: zero-byte container elements
- CVE-2026-93925Apache Thrift: C++ `THeaderTransport::writeVarint32()` stack buffer overflow on a negative protocol id
- CVE-2026-93926Apache Thrift: C++ `THeaderTransport::untransform()` leaks the zlib stream on the error path
- CVE-2026-94633Apache Thrift: Dart `TBinaryProtocol.readMessageBegin` allocates from the pre-versioned name length
- CVE-2026-94634Apache Thrift: Python `TJSONProtocol` has a string length limit that is off by default
- CVE-2026-103885Apache Directory LDAP API: Denial of service via crafted telephone number values
- CVE-2026-103877Apache Directory LDAP API: Unsafe loading of Java code from LDAP schema elements
- CVE-2026-103880Apache Directory LDAP API: Denial of service via excessive bcrypt cost factor in stored passwords
- CVE-2026-103878Apache Directory LDAP API: Injection of plaintext responses during StartTLS
- CVE-2026-103552Apache Directory LDAP API: A unbound client can send a deeply nested search filter that overflows the stack in the server's decoder
- CVE-2026-94639Apache Thrift: Java `TSaslNonblockingServer`: residual of CVE-2026-61373 (thread-death black hole + no cross-connection budget)
- CVE-2026-102731Apache Directory LDAP API: Denial of service via excessive memory allocation in BER decode
- CVE-2026-94635Apache Thrift: Lua `TBinaryProtocol:readMessageBegin` bypasses `checkStringSize` on the pre-versioned name
- CVE-2026-63686Apache HTTP Server: mod_xml2enc crash on charset conversion failure
- CVE-2026-93546Apache HTTP Server: mod_dav_fs namespace overflow
- CVE-2026-79768Apache HTTP Server: mod_userdir information disclosure
- CVE-2026-73637Apache HTTP Server: mod_auth_digest DoS attack