#apache
20 articles
CVE-2026-83542 and CVE-2026-82907: RCE and Authentication Bypass in Apache OFBiz
Two critical vulnerabilities in Apache OFBiz 24.09 before 24.09.08: Groovy code injection enables unauthenticated remote code execution, and a captured externalLoginKey yields a persistent victim session...
CVE-2026-49845: SQL injection in Hive Metastore — tampering with Apache Hive warehouse metadata
Apache Hive before 4.2.1 lets an authenticated user with Hive Metastore API access read and modify partition metadata through a crafted partition name in a metastore RPC request...
CVE-2026-59083: security constraint bypass via URL encoding in Apache Tomcat rewrite valve (CVSS 9.1)
Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0...
CVE-2026-59084: insufficient documentation for secure EncryptInterceptor setup in Apache Tomcat (CVSS 9.1)
Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented. This issue affects Apache Tomcat: ...
CVE-2026-33264: unrestricted import_string in Apache Airflow DAG deserialization (CVSS 9.8)
A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embed a...
CVE-2026-40047: argument injection in Apache Camel Docling component (CVSS 9.1)
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache Camel Docling component. The camel-docling component invokes the external `docling` command-...
CVE-2026-48203: header-driven injection and SSRF in Apache Camel Solr component (CVSS 9.1)
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Improper Input Validation, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel Solr com...
CVE-2026-48205: header-controlled DNS parameters and SSRF in Apache Camel DNS component (CVSS 9.1)
Improper Input Validation, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel DNS component. The camel-dns producers read DNS operation parameters - the resolver to query, the name or d...
CVE-2026-44631: buffer underwrite via crafted configuration regexes in Apache HTTP Server (CVSS 9.8)
Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to ...
CVE-2026-42252: Command Injection in Apache Airflow
Apache Airflow's official documentation at `core-concepts/dag-run.html` ("Passing Parameters when triggering Dags") showed a verbatim `BashOperator(bash_command="echo value: {{ dag_run.conf['conf1'] }...
CVE-2026-44930: LDAP Injection in Apache CXF (XKMS server)
An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository. Users are recommended...
CVE-2026-31986: Hard-coded cryptographic key in Apache OFBiz
Use of Hard-coded Cryptographic Key vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue....
CVE-2026-41919: LDAP Injection in Apache OFBiz
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade...
CVE-2026-28780: Heap-based buffer overflow in Apache HTTP Server mod_proxy_ajp
Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_...
CVE-2026-42778: Incomplete deserialization fix in Apache MINA (2.1.X/2.2.X branches)
The fix for CVE-2026-41409 was not applied to the 2.1.X and 2.2.X branches of Apache MINA. The classname allowlist in AbstractIoBuffer.getObject() was applied too late - a static initializer in the class to be read might already have executed.
CVE-2026-42779: Deserialization allowlist bypass in Apache MINA (2.1.X/2.2.X)
The fix for CVE-2026-41635 was not applied to the 2.1.X and 2.2.X branches. AbstractIoBuffer.resolveClass() in Apache MINA contains two branches; one (for static classes/primitive types) does not check the class at all, bypassing the allowlist.
CVE-2026-33557: SASL OAuth JWT validation flaw in Apache Kafka
A possible security vulnerability has been identified in Apache Kafka. By default, the broker property `sasl.oauthbearer.jwt.validator.class` is set to `org.apache.kafka.common.security.oauthbearer.D...
CVE-2026-25917: XCom arbitrary code execution by DAG authors in Apache Airflow
Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly tru...
CVE-2026-34197: Apache ActiveMQ Improper Input Validation Vulnerability
Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection....
CVE-2025-57735: JWT token reuse after logout in Apache Airflow
When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted. In Airflow 3.2 we implemented the mechanis...