Apache vulnerabilities
3,063 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-90885Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity Declared in That Body Was Resolved
- CVE-2026-94386Apache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Credentials Token Cache
- CVE-2026-110748Apache SIS: CWE-22: improper limitation of paths to GML, GeoTIFF, NADCON or NTv2 files
- CVE-2026-110733Apache SIS: SQL injection via unvalidated ORDER BY sort expression in the SQL feature store
- CVE-2026-95628Apache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incomplete Fix of CVE-2026-40047)
- CVE-2026-95629Apache Camel: Camel-Docling Unvalidated Output Path Header Enables Writing Conversion Output to an Arbitrary Directory
- CVE-2026-95663Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by…
- CVE-2026-95664Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple Expressions
- CVE-2026-101259Apache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer Exceptions
- CVE-2026-113582Apache Abdera: XML external entity expansion in Atom document parsing
- CVE-2026-103634Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in Count-Min sketch deserialization allows memory corruption via a crafted sketch
- CVE-2026-112381Apache Traffic Server: Nullptr dereference in net_write_io on a POST half-close with chunked response
- CVE-2026-111817Apache Traffic Server: Dropping chunked trailers stalls a passthrough transfer until timeout
- CVE-2026-111812Apache Traffic Server: origin_server_auth signs client-controlled AWS headers under the proxy's IAM credentials
- CVE-2026-111811Apache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network with no authentication
- CVE-2026-111809Apache Traffic Server: HEAD requests carrying Content-Length or Transfer-Encoding enable request smuggling
- CVE-2026-111810Apache Traffic Server: Unthrottled per-header diagnostic logging enables a log-flood denial of service
- CVE-2026-111815Apache Traffic Server: TLS session ticket resumption bypasses per-SNI verify_client STRICT enforcement
- CVE-2026-111814Apache Traffic Server: Default server_session_sharing.match omits MASK_CERT, allowing pooled mTLS identity confusion at the origin
- CVE-2026-111808Apache Traffic Server: HTTP/2 DATA frame padding underflow lets a client trigger backend worker-pool exhaustion
- CVE-2026-111805Apache Traffic Server: HTTP/2 Content-Length truncation lets a client trigger backend worker-pool exhaustion
- CVE-2026-111816Apache Traffic Server: A malformed 302 response bypasses parse-error rejection through the Transfer-Encoding: chunked carve-out
- CVE-2025-55702Apache Traffic Server: An unread Expect: 100-continue request body is framed as a new request
- CVE-2025-31699Apache Traffic Server: Origin connection still owed a request body is reused, enabling request smuggling
- CVE-2026-111804Apache Traffic Server: wasm plugin has a use-after-free and forwards unvalidated guest metric IDs
- CVE-2026-111813Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick convert in the default configuration
- CVE-2026-105945Apache Pulsar: Improper Validation of Package Name Components Allows Cross-Tenant Package Access in Filesystem Package Storage
- CVE-2026-105944Apache Pulsar Manager: Missing authentication and authorization and disclosure of the Pulsar admin credential; end of life
- CVE-2026-105942Apache Pulsar: Original principal of proxied requests authorized with the proxy's authentication data, allowing privilege escalation
- CVE-2026-105938Apache Pulsar: Subscription authorization policies not enforced by namespace-level backlog and unsubscribe operations and by topic expire-all