Apache Software Foundation vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-115748 **UNSUPPORTED WHEN ASSIGNED**  Authorization bypass in Apache Vysper, all versions.High 8.8 · Oct 26, 2026
• CVE-2026-115721 **UNSUPPORTED WHEN ASSIGNED**  Unbounded allocation in XML parsing in Apache Vysper; all versions, may lead to an out of memory condition.High 7.5 · Oct 26, 2026
• CVE-2026-90885 Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component.High 7.5 · Oct 26, 2026
• CVE-2026-113582 UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-sidHigh 8.7 · Oct 22, 2026
• CVE-2026-112381 Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origin response is being High 8.2 · Oct 21, 2026
• CVE-2026-111815 Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verify_client SHigh 7.8 · Oct 21, 2026
• CVE-2026-111814 Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction confiHigh 7.8 · Oct 21, 2026
• CVE-2026-111812 Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials.High 7 · Oct 21, 2026
• CVE-2026-111811 Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache.Critical 9.4 · Oct 21, 2026
• CVE-2026-111810 Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a request carrying many sucHigh 8.7 · Oct 21, 2026
• CVE-2026-111808 Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame.High 7.7 · Oct 21, 2026
• CVE-2026-111805 Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value.High 7.7 · Oct 21, 2026
• CVE-2026-111816 Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out bypasCritical 9.2 · Oct 21, 2026
• CVE-2026-111813 Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) configuration.Critical 10 · Oct 21, 2026
• CVE-2026-111804 Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to theHigh 8.8 · Oct 21, 2026
• CVE-2026-105945 The Pulsar Packages Management Service can be configured to store packages on the local filesystem of the broker by using the filesystem storage provider.High 7.7 · Oct 21, 2026
• CVE-2026-105944 Apache Pulsar Manager is a web console for administering Apache Pulsar clusters.Critical 10 · Oct 21, 2026
• CVE-2026-105942 When a configured proxy role sends a request to the broker on behalf of another user (the original principal), the broker is designed to authorize both the proxHigh 7.7 · Oct 21, 2026
• CVE-2026-105937 Apache Pulsar shadow topics (PIP-180) are topics that read the stored messages of a source topic from that topic's managed ledger.High 8.7 · Oct 21, 2026
• CVE-2026-105934 The Apache Pulsar broker admin REST API provides a truncate operation for persistent topics (DELETE /admin/v2/persistent/{tenant}/{namespace}/{topic}/truncate).High 7.2 · Oct 21, 2026
• CVE-2025-55702 When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the clHigh 7 · Oct 21, 2026
• CVE-2025-31699 Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fullyCritical 9.1 · Oct 21, 2026
• CVE-2026-105869 Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token (JWT).Critical 9.2 · Oct 21, 2026
• CVE-2026-82230 Uncontrolled recursion in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server crash via sendinHigh 7.5 · Oct 21, 2026
• CVE-2026-74757 Uncontrolled resource allocation in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server allocaHigh 7.5 · Oct 21, 2026