Apache CVEs
3,065 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-28780Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header()
- CVE-2026-29168Apache HTTP Server: mod_md unrestricted OCSP response
- CVE-2026-43868Apache Thrift: Rust implementation vulnerable to CVE-2020-13949 pattern
- CVE-2026-43870Apache Thrift: Node.js web_server.js multi-vulnerability
- CVE-2026-43869Apache Thrift: TSSLTransportFactory.java hostname verification
- CVE-2026-40682Apache OpenNLP: XXE via Dictionary Parsing in DictionaryEntryPersistor
- CVE-2026-42810Apache Polaris: could broaden vended S3 credentials through wildcard-bearing namespace or table names
- CVE-2026-42027Apache OpenNLP: Arbitrary Class Instantiation via Model Manifest in ExtensionLoader
- CVE-2026-42440Apache OpenNLP: OOM DoS via Unbounded Array Allocation in AbstractModelReader
- CVE-2026-42811Apache Polaris: could broaden vended GCS credentials through unescaped identifier content in access-boundary CEL conditions
- CVE-2026-42809Apache Polaris: staged table creation could vend storage credentials for unvalidated locations
- CVE-2026-42812Apache Polaris: No protection on `write.metadata.path`
- CVE-2026-40563Apache Atlas: Script injection allows access to unintended data
- CVE-2026-29169Apache HTTP Server: mod_dav_lock indirect lock crash
- CVE-2026-23918Apache HTTP Server: http2: double free and possible RCE on early reset
- CVE-2026-33006Apache HTTP Server: mod_auth_digest timing attack
- CVE-2026-33007Apache HTTP Server: mod_authn_socache crash
- CVE-2026-33523Apache HTTP Server: multiple modules: HTTP response splitting forwarding malicious status line
- CVE-2026-33857Apache HTTP Server: Off-by-one OOB reads in AJP getter functions
- CVE-2026-34032Apache HTTP Server: mod_proxy_ajp: Heap Buffer Over-Read Due to Missing Null-Termination Check (ajp_msg_get_string)
- CVE-2026-34059Apache HTTP Server: mod_proxy_ajp: Heap Over-Read and memory disclosure in ajp_parse_data()
- CVE-2026-24072Apache HTTP Server: mod_rewrite elevation of privileges via ap_expr
- CVE-2026-42778Apache MINA: CWE-502 Deserialization of Untrusted Data (take 2)
- CVE-2026-42779Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE (take 2)
- CVE-2026-42404Apache Neethi: Unrestricted HTTP Redirect Following in Policy References
- CVE-2026-42402Apache Neethi: Policy Normalization Unbounded Resource Allocation DoS
- CVE-2026-42403Apache Neethi: Circular Policy Reference Infinite Loop
- CVE-2026-41016Apache Airflow Providers SMTP: No certificate validation on SMTP STARTTLS connections in SMTP provider
- CVE-2026-41873Pony Mail: Admin account takeover via request smuggling
- CVE-2026-41636Apache Thrift: Node.js skip() recursion