Apache vulnerabilities
3,063 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-86247Apache Tomcat Native: Client certificate requirements can be down-graded
- CVE-2026-86246Apache Tomcat Native: Insecure OpenSSL options enabled
- CVE-2026-86243Apache Tomcat Native: DoS via TLS handshake
- CVE-2026-87022Apache Tomcat: WebSocket message smuggling with per-message-deflate
- CVE-2026-86350Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up
- CVE-2026-86248Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled
- CVE-2026-79677Apache Tomcat: WebSocket DoS due to lost asynchronous write timeout
- CVE-2026-78437Apache Tomcat: HTTP/2 DoS via malformed request
- CVE-2026-78383Apache Tomcat: AJP DoS via missing request body
- CVE-2026-77791Apache Tomcat: DoS via busy wait during WebSocket close
- CVE-2026-77762Apache Tomcat: Stale HPACK emitter injects trailers into recycled pooled Request
- CVE-2026-77756Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests
- CVE-2026-76183Apache Tomcat: Bypass of security constraints for WebSocket endpoints
- CVE-2026-75973Apache Tomcat: Cross-context authentication mix-up with Jakarta Authentication configured
- CVE-2026-73581Apache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore
- CVE-2026-94243Apache Sling Security Bundle: RefererFilter accepts weaker-than-origin evidence
- CVE-2026-94251Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resource
- CVE-2026-91928Apache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf protection mechanisms
- CVE-2026-96443Apache Doris: JDBC driver URL validation bypass leads to remote code execution
- CVE-2026-91852Apache Sling XSS: CWE-79 multiple raw-string break-outs and ReDOS in XSSImpl
- CVE-2026-91999Apache Sling XSS: Improper escaping in the XSS Webconsole plugin
- CVE-2026-92001Apache Sling XSS: Missing parser resource limits
- CVE-2026-73192Apache Sling XSS: XSS possible through XSSAPI.getValidHref()
- CVE-2026-31377Apache Doris: Improper Authentication Allows Unauthorized Access to FE Meta Service
- CVE-2026-82331Apache BuildStream: tar source extraction escape
- CVE-2026-70410Apache Calcite Avatica: Unrestricted class initialization when instantiating plugins
- CVE-2026-94301Apache MINA: CVE-2026-47065 resolveProxyClass fix missing from 2.0.X and 2.1.X branches (2.0.30 / 2.1.14) ZDRES-232
- CVE-2026-86473Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry
- CVE-2026-75158Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter
- CVE-2026-82355Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation