Apache vulnerabilities
3,063 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-58163Apache Traffic Server: Cache deserialization and lifetime errors can corrupt state or crash the server
- CVE-2026-58162Apache Traffic Server: Certifier plugin trusts client SNI when generating certificates
- CVE-2026-58161Apache Traffic Server: Memory-safety errors in TLS and SNI handling can crash the server
- CVE-2026-59243Apache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (`verify_signature` defaults to `False`)
- CVE-2026-58160Apache Traffic Server: Out-of-bounds reads while parsing DNS responses
- CVE-2026-58159Apache Traffic Server: Listener and ACL handling allow access-control bypass
- CVE-2026-58158Apache Traffic Server: PROXY protocol parsing has port truncation and a stack overflow
- CVE-2026-58157Apache Traffic Server: Improper server-session reuse can expose data across client connections
- CVE-2026-58156Apache Traffic Server: URL and port parsing errors allow access-control bypass
- CVE-2026-58155Apache Traffic Server: Header-name length truncation enables header aliasing and request smuggling
- CVE-2026-58154Apache Traffic Server: Memory-safety errors in MIME and header parsing
- CVE-2026-65325Apache Traffic Server: HTTP/2 multiplexed origin sessions are reused without certificate re-verification
- CVE-2026-65324Apache Traffic Server: HTTP/2 and HTTP/3 dechunking removes per-stream buffer cap, allowing memory exhaustion
- CVE-2026-58153Apache Traffic Server: HTTP/2 to HTTP/1 conversion forwards origin trailers to clients unsafely
- CVE-2026-58152Apache Traffic Server: Integer-handling errors in HPACK/XPACK decoding corrupt memory
- CVE-2026-58151Apache Traffic Server: Abusive HTTP/2 framing can exhaust resources and crash the server
- CVE-2026-58150Apache Traffic Server: HTTP/2 requests with Transfer-Encoding are not rejected, allowing request smuggling
- CVE-2026-57834Apache Traffic Server: Malformed chunked message body allows request smuggling
- CVE-2026-33930Apache Traffic Server: Buffer overflow via Host field that has a long string value
- CVE-2026-24033Apache Traffic Server: Request smuggling via chunked extension quoted-string parsing
- CVE-2026-33267Apache Traffic Server: Untrusted @ headers can spoof ATS internal metadata
- CVE-2026-22068Apache Traffic Server: Regex mappings match with malicious domain names
- CVE-2026-41920Apache Traffic Server: SNI to Host header matching policy is not properly enforced
- CVE-2026-66299Apache Tomcat: DoS via WebSocket chat example
- CVE-2026-66713Apache Axis2/Java: deserialization of untrusted Data
- CVE-2026-59878Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All: AMQP NIO negative frame size validation bypass leading to DoS
- CVE-2026-61487Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authorization bypass via temporary composite destinations
- CVE-2026-66391Apache Wicket: leaked and missing CSP headers
- CVE-2026-66390Apache Wicket: crafted Link URL strings can break out of the JavaScript sequence
- CVE-2026-66053Apache Thrift: Python TSSLSocket Hostname Matcher Import