Apache CVEs
3,093 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2021-35515Apache Commons Compress 1.6 to 1.20 denial of service vulnerability
- CVE-2021-33037Incorrect Transfer-Encoding handling with HTTP/1.0
- CVE-2021-30640Auth weakness in JNDIRealm
- CVE-2021-30639DoS after non-blocking IO error
- CVE-2021-30129DoS/OOM leak vulnerability in Apache Mina SSHD Server
- CVE-2021-33192Display information UI XSS
- CVE-2021-26920Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended
- CVE-2021-35474Dynamic stack buffer overflow in cachekey plugin
- CVE-2021-32567Reading HTTP/2 frames too many times
- CVE-2021-32566Specific sequence of HTTP/2 frames can cause ATS to crash
- CVE-2021-32565HTTP Request Smuggling, content length with invalid charters
- CVE-2021-27577Incorrect handling of url fragment leads to cache poisoning
- CVE-2021-26461malloc, realloc and memalign implementations are vulnerable to integer wrap-arounds
- CVE-2021-30468Apache CXF Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter
- CVE-2020-9493Java deserialization in Chainsaw
- CVE-2021-31618NULL pointer dereference on specially crafted HTTP/2 request
- CVE-2021-31812A carefully crafted PDF file can trigger an infinite loop while loading the file
- CVE-2021-31811A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading a tiny file
- CVE-2021-30641Unexpected URL matching with 'MergeSlashes OFF'
- CVE-2021-26691Apache HTTP Server mod_session response handling heap overflow
- CVE-2021-26690mod_session NULL pointer dereference
- CVE-2020-35452mod_auth_digest possible stack overflow by one nul byte
- CVE-2020-13950mod_proxy_http NULL pointer dereference
- CVE-2020-13938Improper Handling of Insufficient Privileges
- CVE-2019-17567mod_proxy_wstunnel tunneling of non Upgraded connections
- CVE-2021-33190Bypass network access control
- CVE-2021-30180Apache Dubbo RCE on customers via Condition route poisoning (Unsafe YAML unmarshaling)
- CVE-2021-30179Apache Dubbo Pre-auth RCE via Java deserialization in the Generic filter
- CVE-2021-25640Open Redirect or SSRF vulnerability usage of parseURL
- CVE-2021-30181Apache Dubbo RCE on customers via Script route poisoning (Nashorn script injection)