Apache CVEs
3,065 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-41636Apache Thrift: Node.js skip() recursion
- CVE-2026-41607Apache Thrift: C++ JSON OOB read
- CVE-2026-41606Apache Thrift: c_glib dispatch stack overflow
- CVE-2026-41605Apache Thrift: Swift Compact Protocol integer overflow
- CVE-2026-41604Apache Thrift: Swift Range crash in skip()
- CVE-2026-41602Apache Thrift: Go TFramedTransport uint32 overflow
- CVE-2025-48431Apache Thrift: Specially crafted input can crash a c_glib Thrift server with invalid pointer error.
- CVE-2026-40557Apache Storm Prometheus Reporter: Disabling TLS verification for Prometheus Reporter also disables it for all other connections
- CVE-2026-41081Apache Storm Client: Anonymous principal assigned on TLS client certificate verification failure
- CVE-2026-27172Apache Camel: Unsafe Java deserialization in camel-consul ConsulRegistry allows arbitrary code execution via malicious values read from the Consul KV store
- CVE-2026-33453Apache Camel: CoAP URI Query Parameter to Exchange Header Injection in camel-coap Allows Single-Packet Pre-Auth Remote Code Execution
- CVE-2026-33454Apache Camel: Inbound Header Filter Missing in MailHeaderFilterStrategy Allows Remote Code Execution via MIME Header Injection (CVE-2025-30177 Variant)
- CVE-2026-40022Apache Camel Platform HTTP Main: Authentication Bypass on Non-Root Context Paths in camel main runtime
- CVE-2026-40858Apache Camel: Camel-Infinispan: Unsafe Deserialization in Remote Aggregation Repository
- CVE-2026-41409Apache MINA: CWE-502 Deserialization of Untrusted Data
- CVE-2026-41635Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE
- CVE-2026-40453Apache Camel JMS, Apache Camel CoAP, Apache Camel Google PubSub: Incomplete fix for CVE-2025-27636 in non-HTTP HeaderFilterStrategies (camel-jms, camel-sjms, camel-coap, camel-google-pubsub) allows case-variant header injection
- CVE-2026-40860Apache Camel: Unsafe Deserialization of JMS ObjectMessage in camel-jms, camel-sjms, camel-sjms2 and camel-amqp
- CVE-2026-40048Apache Camel PQC: Unsafe Deserialization from FileBasedKeyLifecycleManager
- CVE-2026-40473Apache Camel Mina: Unsafe Deserialization in MinaConverter.toObjectInput() via TCP/UDP
- CVE-2026-38743Apache Airflow: Dags endpoint might provide access to otherwise inaccessible entities
- CVE-2026-40690Apache Airflow: Assets graph view bypasses DAG level access control displaying unrelated topologies and all DAGs names to unauthorized users
- CVE-2026-23902Apache DolphinScheduler: Users are able to use tenants that are not defined on the platform during workflow execution.
- CVE-2025-62233Apache DolphinScheduler: Deserialization of untrusted data in RPC
- CVE-2026-41044Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE via DestinationView MBean exposed by Jolokia
- CVE-2026-41043Apache ActiveMQ, Apache ActiveMQ Web: ActiveMQ Web Console - XSS vulnerability when browsing queues
- CVE-2026-40466Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery second-stage URI
- CVE-2026-40542Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verification
- CVE-2026-33557Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication
- CVE-2025-66335Apache Doris MCP Server: MCP SQL inject