apache vulnerabilities

Recent CVEs affecting apache products. 120 tracked.

apache has 120 tracked vulnerabilities, 30 critical. A fixed release or vendor patch exists for 120. Most recent: 2026-08-24. Highest priority: CVE-2026-28672 (score 69/100).

• CVE-2026-33267 CRITICAL 10.0 UPGRADE Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: f
• CVE-2026-59243 CRITICAL 9.8 UPGRADE The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so
• CVE-2026-41920 CRITICAL 9.3 UPGRADE Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: fro
• CVE-2026-58153 HIGH 8.3 UPGRADE Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when co
• CVE-2026-22068 HIGH 8.2 UPGRADE Regular Expression without Anchors vulnerability in Apache Traffic Server. This issue affects Apache Traffic
• CVE-2026-23904 HIGH 7.3 UPGRADE Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destina
• CVE-2026-58177 HIGH 8.1 UPGRADE The Apache Traffic Server Cripts framework has out-of-bounds writes, path traversal, and use-after-free errors
• CVE-2026-66907 HIGH 7.5 UPGRADE Relative path traversal vulnerability in Apache Camel Google Storage component. This issue affects Apache C
• CVE-2026-66908 HIGH 7.5 UPGRADE Improper Authentication vulnerability in Apache Camel Platform HTTP Main component. This issue affects Apac
• CVE-2026-24033 HIGH 7.2 UPGRADE Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Traff
• CVE-2026-50622 HIGH 8.8 UPGRADE Description: Missing Authorization in Apache Atlas. A missing authorization vulnerability in Apache Atlas's ad
• CVE-2026-62391 HIGH 8.1 UPGRADE The security fix for CVE-2025-66518 is incomplete. Any client who can access to Apache Kyuubi Server via Kyuub
• CVE-2026-44615 MEDIUM 6.5 UPGRADE Path traversal vulnerability in Apache Zeppelin
• CVE-2026-64607 MEDIUM 5.3 UPGRADE HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the con
• CVE-2026-65325 MEDIUM 4.8 UPGRADE Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying the server certificate co
• CVE-2026-52680 CRITICAL 9.8 UPGRADE Apache Kyuubi REST batch multipart upload handling uses the client-supplied multipart filename when creating a
• CVE-2026-28812 CRITICAL 9.8 UPGRADE UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to es
• CVE-2026-66756 CRITICAL 9.8 DOWNGRADE Improper Protection of Alternate Path vulnerability in Apache Tika. This issue affects Apache Tika: from 4.0.
• CVE-2025-61581 HIGH 7.5 UPGRADE ** UNSUPPORTED WHEN ASSIGNED ** Inefficient Regular Expression Complexity vulnerability in Apache Traffic Cont
• CVE-2026-28811 HIGH 7.5 UPGRADE Debug Messages Revealing Unnecessary Information in Apache JSPWiki up to 2.12.3. Users are recommended to upgr
• CVE-2026-28814 HIGH 7.5 UPGRADE Arbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki up to 2.12.3 allows attacker t
• CVE-2026-66755 HIGH 7.5 UPGRADE Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1.8 through 3.3.1
• CVE-2026-44617 MEDIUM 6.5 UPGRADE LDAP filter injection vulnerability in Apache Zeppelin
• CVE-2026-44616 MEDIUM 6.5 UPGRADE LDAP injection vulnerability in Apache Zeppelin
• CVE-2026-23985 MEDIUM 6.5 UPGRADE A Regular Expression Denial of Service (ReDoS) vulnerability exists in Apache Superset versions 1.5.0 through
• CVE-2026-28813 HIGH 8.8 UPGRADE Apache JSPWiki, up to 2.12.3, is vulnerable to JSON Hijacking, which leads to csrf vulnerabilities. Users are
• CVE-2026-48910 MEDIUM 6.5 UPGRADE A carefully crafted editing request could trigger an XSS vulnerability on Apache JSPWiki when parsing errors
• CVE-2026-44613 MEDIUM 6.1 UPGRADE Cross-Site Request Forgery (CSRF) vulnerability in Apache Zeppelin
• CVE-2026-23981 MEDIUM 4.3 UPGRADE An Improper Authorization vulnerability exists in Apache Superset allowing an authenticated user with permissi
• CVE-2026-66909 CRITICAL 9.8 UPGRADE Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserializ
• CVE-2026-71558 CRITICAL 9.8 UPGRADE Heap type confusion vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ vers
• CVE-2026-61484 CRITICAL 9.8 MITIGATE ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Lucy. This issue
• CVE-2026-68079 CRITICAL 9.8 UPGRADE In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited
• CVE-2026-71560 CRITICAL 9.1 UPGRADE Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versi
• CVE-2026-68979 CRITICAL 9.8 UPGRADE Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce aut
• CVE-2026-61486 CRITICAL 9.8 MITIGATE ** UNSUPPORTED WHEN ASSIGNED ** Stack-based Buffer Overflow vulnerability in Apache Lucy. This issue affect
• CVE-2026-34191 CRITICAL 9.1 UPGRADE Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache P
• CVE-2026-61466 CRITICAL 9.1 UPGRADE In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the `
• CVE-2026-60053 CRITICAL 9.1 UPGRADE Insufficient Session Expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0
• CVE-2026-68980 CRITICAL 9.1 UPGRADE Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Cont
• CVE-2026-61483 HIGH 7.5 MITIGATE ** UNSUPPORTED WHEN ASSIGNED ** Uncontrolled Recursion vulnerability in Apache Lucy. This issue affects Apa
• CVE-2026-32327 CRITICAL 9.1 UPGRADE A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer whi
• CVE-2026-57817 HIGH 8.1 UPGRADE The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the `c_hash` parameter when opera
• CVE-2026-61372 HIGH 7.5 UPGRADE Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Jena Fu
• CVE-2026-68981 HIGH 7.5 UPGRADE Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jerse
• CVE-2026-66257 HIGH 7.5 UPGRADE A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leadi
• CVE-2026-66273 HIGH 7.5 UPGRADE A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to
• CVE-2026-67465 HIGH 7.5 UPGRADE A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leadi
• CVE-2026-67551 HIGH 7.5 UPGRADE pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to p
• CVE-2026-67588 HIGH 7.5 UPGRADE A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leadi
• CVE-2026-67589 HIGH 7.5 UPGRADE A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to
• CVE-2026-68060 HIGH 7.5 UPGRADE A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to
• CVE-2026-68074 HIGH 7.5 UPGRADE A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leadi
• CVE-2026-66274 HIGH 7.5 UPGRADE A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to
• CVE-2026-67552 HIGH 7.5 UPGRADE A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to
• CVE-2026-67590 HIGH 7.5 UPGRADE A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to
• CVE-2026-67592 HIGH 7.5 UPGRADE It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authent
• CVE-2026-68073 HIGH 7.5 UPGRADE A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to
• CVE-2026-48834 HIGH 7.5 UPGRADE Improper Handling of Length Parameter Inconsistency vulnerability in Apache Answer. This issue affects Apache
• CVE-2026-54225 HIGH 7.5 UPGRADE Apache CXF allows to control the maximum attachment size via the "attachment-max-size"
• CVE-2026-57819 HIGH 7.5 UPGRADE Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParamete
• CVE-2026-71559 HIGH 7.5 UPGRADE Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to
• CVE-2026-60023 HIGH 7.5 UPGRADE Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects
• CVE-2026-64958 HIGH 7.5 UPGRADE An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on
• CVE-2026-65432 HIGH 7.5 UPGRADE Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external en
• CVE-2026-68481 HIGH 7.5 UPGRADE In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and Toke
• CVE-2026-48911 HIGH 7.5 UPGRADE Insufficient Verification of Data Authenticity vulnerability in Apache Answer. This issue affects Apache Answ
• CVE-2026-57818 HIGH 8.1 UPGRADE A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple t
• CVE-2026-63687 CRITICAL 9.1 UPGRADE Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter
• CVE-2026-65583 CRITICAL 9.1 UPGRADE Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required
• CVE-2026-34501 HIGH 7.5 UPGRADE Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects
• CVE-2026-34502 HIGH 7.5 UPGRADE Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affec
• CVE-2026-66275 MEDIUM 6.5 UPGRADE An authenticated attacker could exceed the session flow control incoming window potentially leading to denial
• CVE-2026-66276 MEDIUM 6.5 UPGRADE An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usa
• CVE-2026-66277 MEDIUM 6.5 UPGRADE It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authent
• CVE-2026-67553 MEDIUM 6.5 UPGRADE An authenticated attacker could exceed the session flow control incoming window potentially leading to denial
• CVE-2026-67554 MEDIUM 6.5 UPGRADE An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usa
• CVE-2026-67555 MEDIUM 6.5 UPGRADE It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authent
• CVE-2026-67591 MEDIUM 6.5 UPGRADE An authenticated attacker could exceed the session flow control incoming window potentially leading to denial
• CVE-2026-68075 MEDIUM 6.5 UPGRADE An authenticated attacker could exceed the session flow control incoming window potentially leading to denial
• CVE-2026-68077 MEDIUM 6.5 UPGRADE An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usa
• CVE-2026-68078 MEDIUM 6.5 UPGRADE It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authent
• CVE-2026-68080 MEDIUM 6.5 UPGRADE It was not possible to govern the rate at which the broker would respond to an echo flow, enabling an authenti
• CVE-2026-48912 MEDIUM 6.5 UPGRADE Improper Input Validation vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1.
• CVE-2026-50749 MEDIUM 6.5 UPGRADE Improper Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Any
• CVE-2026-64640 MEDIUM 6.5 UPGRADE Apache Polaris did not consistently validate storage locations supplied during table and view registration. A
• CVE-2026-62354 MEDIUM 4.3 UPGRADE Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows c
• CVE-2026-28672 CRITICAL 9.8 UPGRADE Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ra
• CVE-2026-42537 CRITICAL 9.8 UPGRADE Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0 Users are recommended to upgrade to ver
• CVE-2026-44416 CRITICAL 9.8 UPGRADE Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger <
• CVE-2026-55799 CRITICAL 9.8 UPGRADE Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger <= 2.8.0 Users are recommende
• CVE-2026-40920 CRITICAL 9.8 UPGRADE Privilege Escalation via URL Parameter is reported in Apache Ranger versions <= 2.8.0. Users are recommended
• CVE-2026-32227 CRITICAL 9.8 UPGRADE SQL Injection vulnerability vulnerability in Apache Ranger. This issue affects . Users are recommended to up
• CVE-2026-71290 CRITICAL 9.1 UPGRADE Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerific
• CVE-2026-61899 HIGH 7.5 UPGRADE Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspat
• CVE-2026-55814 HIGH 7.5 UPGRADE Missing Authentication in Apache Ranger Download APIs on versions <= 2.8.0. Users are recommended to upgrade t
• CVE-2026-67260 HIGH 7.3 UPGRADE Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swe
• CVE-2026-65942 HIGH 7.5 UPGRADE TLS hostname verification issue in Apache Ranger Client Code in versions <= 2.8.0. Users are recommended to up
• CVE-2026-65948 HIGH 7.3 UPGRADE UnixAuth lacks brute-force protection in Apache Ranger versions <= 2.8.0.  Note:  UnixAuth is NOT a recommende
• CVE-2026-67587 HIGH 8.8 UPGRADE Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its constructor, whic
• CVE-2026-58076 HIGH 8.8 UPGRADE Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class nam
• CVE-2026-65945 MEDIUM 6.5 UPGRADE Logs contain replayable JWT tokens in Apache Ranger versions <= 2.8.0 Users are recommended to upgrade to vers
• CVE-2026-68968 HIGH 7.5 UPGRADE Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the `backf
• CVE-2026-68872 MEDIUM 6.5 UPGRADE The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resol
• CVE-2026-68868 MEDIUM 6.5 UPGRADE The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team sco
• CVE-2026-65017 MEDIUM 6.5 UPGRADE Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments
• CVE-2026-68871 MEDIUM 6.5 UPGRADE The Yandex Lockbox secrets backend in Apache Airflow's Yandex provider resolved a team-scoped Connection or Va
• CVE-2026-59242 MEDIUM 5.4 UPGRADE Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint passed a string-literal
• CVE-2026-68969 MEDIUM 6.5 UPGRADE Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext when they w
• CVE-2026-68971 MEDIUM 6.5 UPGRADE Apache Airflow's asset materialization endpoint (`POST /api/v2/assets/{asset_id}/materialize`) and the XCom re
• CVE-2026-59244 MEDIUM 6.5 UPGRADE Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered
• CVE-2026-68076 MEDIUM 5.4 UPGRADE Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the w
• CVE-2026-68970 MEDIUM 6.5 UPGRADE Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets store
• CVE-2026-54183 MEDIUM 4.3 UPGRADE Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the U
• CVE-2026-73240 CRITICAL 9.8 UPGRADE Specifically crafted inputs may lead to git argument injection in Apache Allura. This issue affects Apache Al
• CVE-2026-69223 CRITICAL 9.1 UPGRADE Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). This issue affects Apache Allu
• CVE-2026-73237 MEDIUM 6.1 UPGRADE XSS vulnerability in Markdown handling in Apache Allura. This issue affects Apache Allura: from 1.10.0 before
• CVE-2026-73238 MEDIUM 6.1 UPGRADE XSS vulnerability in code display in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users a
• CVE-2026-73239 MEDIUM 6.5 UPGRADE Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache
• CVE-2026-34884 CRITICAL 9.8 UPGRADE SSRF via set_skywalking_url Tool and GraphQL expression injection vulnerability in Apache SkyWalking MCP.

FAQ

How do I fix apache vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is apache being exploited right now?

None of the tracked apache CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which apache CVE should I patch first?

CVE-2026-28672 currently ranks highest (69/100): Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ra.

Products

• airflow
• allura
• answer
• apache-airflow-providers-amazon
• apache-airflow-providers-apache-yandex
• apache-airflow-providers-fab
• apache-airflow-providers-google
• apr-util
• atlas
• camel
• cxf
• fory
• httpclient
• jena fuseki
• jspwiki
• kyuubi
• lucy
• nifi
• polaris
• qpid broker-j
• qpid proton-dotnet
• qpid proton-j
• qpid protonj2
• ranger
• skywalking mcp
• superset
• tapestry
• tika
• traffic control
• traffic server
• zeppelin

← Back to latest CVEs