Apache vulnerabilities
3,063 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-68078Apache Qpid Broker-J: Unable to govern the maximum number of transfer frames per incoming delivery
- CVE-2026-66277Apache Qpid Proton-J: Unable to govern the maximum number of transfer frames per incoming delivery
- CVE-2026-67554Apache Qpid Proton Dotnet: Unbounded disposition range handling can lead to denial of service
- CVE-2026-68077Apache Qpid Broker-J: Unbounded disposition range handling can lead to denial of service
- CVE-2026-66276Apache Qpid Proton-J: Unbounded disposition range handling can lead to denial of service
- CVE-2026-67591Apache Qpid ProtonJ2: Incoming session flow control window can be exceeded
- CVE-2026-67553Apache Qpid Proton Dotnet: Incoming session flow control window can be exceeded
- CVE-2026-68075Apache Qpid Broker-J: Incoming session flow control window can be exceeded
- CVE-2026-66275Apache Qpid Proton-J: Incoming session flow control window can be exceeded
- CVE-2026-67590Apache Qpid ProtonJ2: Unbounded type nesting can lead to pre-authentication stackoverflow
- CVE-2026-67552Apache Qpid Proton Dotnet: Unbounded type nesting can lead to pre-authentication stackoverflow
- CVE-2026-68073Apache Qpid Broker-J: Unbounded type nesting can lead to pre-authentication stack overflow
- CVE-2026-66274Apache Qpid Proton-J: Unbounded type nesting can lead to pre-authentication stackoverflow
- CVE-2026-67589Apache Qpid ProtonJ2: Type size/count handling can lead to excessive allocation pre-authentication
- CVE-2026-67551Apache Qpid Proton Dotnet: Type size/count handling can lead to excessive allocation pre-authentication
- CVE-2026-68060Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication
- CVE-2026-66273Apache Qpid Proton-J: Type size/count handling can lead to excessive allocation pre-authentication
- CVE-2026-67588Apache Qpid ProtonJ2: Unbounded symbol value caching can lead to pre-authentication resource exhaustion
- CVE-2026-67465Apache Qpid Proton Dotnet: Unbounded symbol value caching can lead to pre-authentication resource exhaustion
- CVE-2026-68074Apache Qpid Broker-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustion
- CVE-2026-66257Apache Qpid Proton-J: Unbounded symbol value caching can lead to pre-authentication resource exhaustion
- CVE-2026-68981Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests
- CVE-2026-68980Apache NiFi: Authorization Bypass for Parameter Context Asset Deletion
- CVE-2026-62354Apache NiFi: Incorrect Authorization for Parameter Context Validation Requests
- CVE-2026-68979Apache NiFi: Missing Authorization for Components Referenced by Parameter Context Updates
- CVE-2026-61372Apache Jena Fuseki: Web requests using SPARQL Update can escape file restrictions
- CVE-2026-44615Path traversal in NotebookRepo note and folder path composition
- CVE-2026-64607Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS
- CVE-2026-62391Apache Kyuubi: kyuubi.session.local.dir.allow.list bypass via unprefixed Spark file-conf aliases
- CVE-2026-66756Apache Tika: unpack endpoint in tika-server allows configuration with unsecureFeatures=false