Apache CVEs
3,067 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2025-52434Apache Tomcat: APR/Native Connector crash leading to DoS
- CVE-2025-53020Apache HTTP Server: HTTP/2 DoS by Memory Increase
- CVE-2025-49812Apache HTTP Server: mod_ssl TLS upgrade attack
- CVE-2025-49630Apache HTTP Server: mod_proxy_http2 denial of service
- CVE-2025-23048Apache HTTP Server: mod_ssl access control bypass with session resumption
- CVE-2024-43394Apache HTTP Server: SSRF on Windows due to UNC paths
- CVE-2024-47252Apache HTTP Server: mod_ssl error log variable escaping
- CVE-2024-43204Apache HTTP Server: SSRF with mod_headers setting Content-Type header
- CVE-2024-42516Apache HTTP Server: HTTP response splitting
- CVE-2025-27446Apache APISIX Java Plugin Runner: Local listening file permissions in APISIX plugin runner allow a local attacker to elevate privileges
- CVE-2024-35164Apache Guacamole: Improper input validation of console codes
- CVE-2025-46647Apache APISIX: improper validation of issuer from introspection discovery url in plugin openid-connect
- CVE-2025-32897Apache Seata (incubating): Deserialization of untrusted Data in Apache Seata Server
- CVE-2025-50213Apache Airflow Providers Snowflake: Potential SQL injection in CopyFromExternalStageToSnowflakeOperator
- CVE-2025-32896Apache SeaTunnel: Unauthenticated insecure access
- CVE-2025-31698Apache Traffic Server: Client IP address from PROXY protocol is not used for ACL
- CVE-2025-49763Apache Traffic Server: Remote DoS via memory exhaustion in ESI Plugin
- CVE-2025-48976Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers
- CVE-2025-49124Apache Tomcat: exe side-loading via icalcs.exe in Tomcat installer for Windows
- CVE-2025-49125Apache Tomcat: Security constraint bypass for pre/post-resources
- CVE-2025-48988Apache Tomcat: FileUpload large number of parts with headers DoS
- CVE-2025-47869Apache NuttX RTOS: examples/xmlrpc: Fix calls buffers size.
- CVE-2025-47868Apache NuttX RTOS: tools/bdf-converter.: tools/bdf-converter: Fix loop termination condition.
- CVE-2025-30675Apache CloudStack: Unauthorised template/ISO list access to the domain/resource admins
- CVE-2025-22829Apache CloudStack: Unauthorised access to dedicated resources in Quota plugin
- CVE-2025-26521Apache CloudStack: CKS cluster in project exposes user API keys
- CVE-2025-47849Apache CloudStack: Insecure access of user's API/Secret Keys in the same domain
- CVE-2025-47713Apache CloudStack: Domain Admin can reset Admin password in Root Domain
- CVE-2025-27817Apache Kafka Client: Arbitrary file read and SSRF vulnerability
- CVE-2025-27819Apache Kafka: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration