Apache CVEs
3,063 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-40008Apache IoTDB: Arbitrary Class Instantiation via Pipe Transfer RPC
- CVE-2026-40007Apache IoTDB: Unauthenticated unbounded recursion in IoTDB AirGap receiver's E-language prefix parser causes per-connection StackOverflowError
- CVE-2026-40006Apache IoTDB: Unauthenticated heap-exhaustion DoS via unbounded allocation in IoTDB AirGap pipe receiver
- CVE-2026-40005Apache IoTDB: Path Traversal in Pipe File Transfer Receiver
- CVE-2026-28564Apache IoTDB: REST Basic Authentication Accepts Stale Cached Credentials
- CVE-2026-57111Apache Helix REST: Permissive CORS Configuration in REST API Allows Unrestricted Cross-Origin
- CVE-2026-41042Apache Gravitino: Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter
- CVE-2026-33264Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()
- CVE-2026-49487Apache Airflow: Task-instance API exposes secrets in deferred trigger kwargs
- CVE-2026-48828Apache Airflow: Bulk JSON Variables bypass should_hide_value_for_key - redact() called without the key
- CVE-2026-49296Apache Airflow: Per-DAG read bypass discloses co-located DAGs' source via GET /api/v2/dagSources/{dag_id}
- CVE-2026-48891Apache Airflow: /ui/dependencies scheduling graph leaks unreadable Dag identifiers via trigger/sensor dep.source/dep.target
- CVE-2026-48892Apache Airflow: Config API leaks per-key secrets backend kwargs - masker bypass on synthetic options
- CVE-2026-43825Apache OpenNLP :: Core :: ML :: LibSVM: Unsafe Java Deserialization in SvmDoccatModel
- CVE-2026-49297Apache Airflow Google provider: Path traversal via GCS object names → local/SFTP filesystem (GCSToSFTPOperator + GCSTimeSpanFileTransformOperator)
- CVE-2026-46588Apache Camel: CouchDB: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input
- CVE-2026-46587Apache Camel: Couchbase: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input
- CVE-2026-49042Apache Camel: langchain4j-tools: filter tool argument headers against declared parameters
- CVE-2026-24013Apache IoTDB: Authentication Bypass via Forged SessionID in Thrift RPC
- CVE-2026-24012Apache IoTDB: Denial of Service via Resource Exhaustion in Aggregation Query
- CVE-2026-43866Apache Camel, Apache Camel: Camel JMS - CVE-2026-40860 fix bypass via DefaultExchangeHolder
- CVE-2026-24014Apache IoTDB: Path Traversal in DataNode Internal RPC Trigger JAR Upload Allows Arbitrary File Write
- CVE-2026-43867Apache Camel: Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter
- CVE-2026-56140Apache Camel AWS2 SNS: An inbound Camel-namespace filter was added to Sns2HeaderFilterStrategy to align it with sibling components
- CVE-2026-56139Apache Camel Undertow: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body, disclosing sensitive internal information to unauthenticated clients
- CVE-2026-55994Apache Camel Iggy: The inbound consumer maps externally-supplied Iggy message user-headers into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control headers - enabling control over internal behaviour
- CVE-2026-55993Apache Camel Atmosphere Websocket: The inbound consumer maps externally-supplied WebSocket query parameters into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control headers - enabling influencing internal behaviour
- CVE-2026-53913Apache Camel Keycloak: KeycloakSecurityPolicy verifies the bearer access token only inside its role and permission checks, so in the default configuration the token is never verified and any non-null bearer value is accepted
- CVE-2026-49365Apache Camel: Camel-Netty-HTTP: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body, disclosing sensitive internal information to unauthenticated clients
- CVE-2026-49099Apache Camel Salesforce: Non-Camel-prefixed Exchange header constants bypass the HTTP header filter, allowing an HTTP client to influence internal behaviour