Apache vulnerabilities
3,063 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-91867Apache Neethi: Remote policy fetch lacks a total timeout, allowing a slow server to hang the request indefinitely
- CVE-2026-91866Apache Neethi: Crafted policies cause unbounded work during intersection leading to denial of service
- CVE-2026-91865Apache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of service
- CVE-2026-91864Apache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustion
- CVE-2026-91863Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of service
- CVE-2026-47321Apache MINA: Unbounded Decompression Amplification DoS in Zlib.inflate
- CVE-2026-75157Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)
- CVE-2026-92230Apache Karaf: Improper release of ClassLoader references via static ThreadLocal caching
- CVE-2026-70469Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests
- CVE-2026-81866Apache NiFi: Missing Authorization for Assets and Secrets Referenced by Connector Configuration
- CVE-2026-82561Apache NiFi: Missing Authorization for Components Referenced in Flow Update Methods
- CVE-2026-86089Apache NiFi: Missing Process Group Authorization for Connector Migration
- CVE-2026-87976Apache NiFi Registry: Improper Limitation of Pathname in Persisted Extension Bundles
- CVE-2026-76646Apache MyFaces: Denial of Service via Unbounded Request Parsing
- CVE-2026-68536Apache MyFaces: Server-Side Request Forgery / Local File Inclusion Vulnerability
- CVE-2026-84501Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider
- CVE-2026-84439Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources
- CVE-2026-79993Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode
- CVE-2026-59969Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode
- CVE-2026-59739Apache ZooKeeper: Information disclosure via SetWatches reconnect replay
- CVE-2026-86466Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validated
- CVE-2026-76187Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT
- CVE-2026-76186Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity
- CVE-2026-82310Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT access
- CVE-2026-86792Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configuration
- CVE-2026-86462Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions
- CVE-2026-82311Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is always false
- CVE-2026-86465Apache Airflow Akeyless provider: Akeyless secrets backend: team-scope guard bypass via user-controlled key
- CVE-2026-82427Apache Storm Nimbus: Path Traversal as the Supervisor User via Unsanitised Blobstore Map Local Name
- CVE-2026-82428Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys