Apache CVEs
3,063 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-58662Apache Thrift: C++ THeaderTransport::readString() info-header length bounds bypass
- CVE-2026-58389Apache Thrift: Rust binary protocol non-strict path missing string size limit
- CVE-2026-58023Apache Thrift: c_glib heap out-of-bounds read in transport leftover-bytes path
- CVE-2026-55971Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform()
- CVE-2026-55970Apache Thrift: C++ heap out-of-bounds read in THeaderTransport::readHeaderFormat()
- CVE-2026-55969Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: integer overflow in TProtocol::checkReadBytesAvailable()
- CVE-2026-55968Apache Thrift: Node.js quadratic-time DoS in server receive transports
- CVE-2026-49158Apache Thrift: Ruby THeaderTransport ZLIB Decompression Bomb
- CVE-2026-48586Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size Limit
- CVE-2026-48145Apache Thrift: C++ TSSLSocket matchName() RFC 6125 Wildcard Bypass
- CVE-2026-48144Apache Thrift: c_glib TLS Client Missing Hostname Verification
- CVE-2026-45112Apache Thrift: Unbounded Read Leading to Denial of Service
- CVE-2026-43871Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TCompactProtocol varint byte-count limit
- CVE-2026-41608Apache Thrift: Unbounded Zlib Decompression in Python THeaderTransport
- CVE-2026-49326Apache HBase: Missing scanner instance owner check in thrift delegation service
- CVE-2026-46452Apache NimBLE: Mesh Proxy SAR reassembly unbounded append and unchecked failure
- CVE-2026-45816Apache NimBLE: NULL pointer dereference vulnerability in SMP LTK request
- CVE-2026-45815Apache NimBLE: Remote reachable assertion in ATT Read Multiple Variable Response handler
- CVE-2026-45813Apache NimBLE: Incorrect data validation in BASS add/modify source operation
- CVE-2026-45812Apache NimBLE: OOB Read via sizeof(pointer) in Legacy Advertising Report Handler
- CVE-2026-45811Apache NimBLE: Buffer overflow in socket HCI transport
- CVE-2026-66144Apache Neethi: Remote PolicyReference fetch lacks resource bounds
- CVE-2026-66143Apache Neethi: Missing global alternative-output budget across policy computation paths
- CVE-2026-66142Apache Neethi: Uncontrolled recursion in policy processing
- CVE-2026-63317Apache OpenNLP: Arbitrary Class Instantiation in GeneratorFactory via Feature Descriptor XML
- CVE-2026-60080Apache Fory: Rust MetaString heap use-after-free
- CVE-2026-64606Apache Fory, Apache Fory: Class-registration bypass through an auto-admitted SerializedLambda capturing interface
- CVE-2026-64609Apache Fory, Apache Fory: Out-of-Bounds Read via sun.misc.Unsafe in zero-copy java deserialization
- CVE-2026-64608Apache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip paths
- CVE-2026-56623Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git on Windows