Apache Software Foundation

Related CVEsby mentions

• CVE-2026-8261710.0—
  ReDoS in Apache OpenNLP built-in EMAIL and URL regex name finders
  CVE-2026-82617 is a regular-expression denial-of-service flaw (CWE-1333, inefficient regex complexity) in the two built-in name-finder patterns, EMAIL and URL, exposed by opennlp.tools.namefind.RegexNameFinderFactory in Apache OpenNLP. An application that obtains these finders via RegexNameFinderFactory.getDefaultRegexNameFinders(...) and applies them to untrusted text through RegexNameFinder.find(String[]) or find(String) can be driven into quadratic backtracking or unbounded matcher recursion by small crafted inputs: roughly 32 KB of text burns several seconds of CPU per EMAIL scan and returns no match, while roughly 4 KB of &-separated URL query tokens exhausts the thread stack and raises java.lang.StackOverflowError (about 1 KB suffices on worker threads with reduced stacks such as -Xss512k). Because no authentication or special configuration is needed, anyone who can control the text fed to these finders can convert each request into seconds to minutes of pinned CPU or abrupt thread death, denying service to the embedding application. Affected are applications embedding Apache OpenNLP 2.0.0 through 2.5.11 or 3.0.0-M1 through 3.0.0-M5 that have selected one of these two built-in finders; the flaw is specific to the built-in EMAIL/URL patterns and does not implicate model-based NER usage. There is no known exploitation, public proof-of-concept, or KEV listing as of now; fixed releases are 2.5.12 and 3.0.0-M6.
  · Apache OpenNLP 2.0.0 through 2.5.11 · Apache OpenNLP 3.0.0-M1 through 3.0.0-M5—
• CVE-2026-418719.8<1%
  Unauthenticated reflection-based job execution in Apache Nutch Server REST API
  CVE-2026-41871 is a missing-authorization flaw (CWE-862) combined with unsafe reflection (CWE-470) in the Nutch Server component, i.e., the Nutch REST API, affecting Apache Nutch versions 1.10 through 1.22. The REST API fails to properly authorize requests, so unauthenticated or untrusted users can send API calls whose externally controlled input determines which classes or code are loaded and executed. An attacker who can reach the exposed Nutch Server can therefore trigger reflection-based job execution, potentially running arbitrary classes or jobs on the server. Only deployments running the optional Nutch Server (REST API) on Nutch 1.10 through 1.22 are affected. There is currently no public proof of concept, no known in-the-wild exploitation, and the issue is not in CISA KEV; the CVSS score has not yet been assigned.
  · Apache Nutch (Nutch Server / Nutch REST API) 1.10 through 1.22; fixed in 1.23, which removes the Nutch Serverniche
• CVE-2026-493649.1<1%
  Pre-Auth Cluster Credential Exposure in Apache ActiveMQ Artemis Discovery
  Apache ActiveMQ Artemis brokers do not enforce authentication for the initial cluster connection handshake (CWE-306, Missing Authentication for Critical Function), so cluster administrative credentials are exchanged without authentication during discovery-driven cluster connections. An unauthenticated, network-adjacent attacker positioned on the same network segment as the brokers can capture these cluster administrative credentials during the handshake. With those credentials, the attacker can gain administrative access to the messaging cluster, compromising broker administration and message flows. Only deployments running affected versions in a clustered configuration that relies on discovery are exposed; this requires the attacker to already have access to the broker network, so internet exposure alone is not the primary risk. No exploitation has been reported, no public proof-of-concept exists, the issue is not in CISA's KEV, and CVSS scoring is pending; version 2.57.0 fixes the flaw.
  · Apache Artemis 2.50.0 through 2.56.0 · Apache ActiveMQ Artemis 1.0.0 through 2.44.0large
• CVE-2026-418708.8<1%
  Unauthenticated RCE via JEXL injection in Apache Nutch REST API
  The Nutch Server component of Apache Nutch (its REST API) fails to require authorization for requests (CWE-862) and allows externally controlled input to select classes and dynamically managed code resources (CWE-470, CWE-913), culminating in JEXL (Java Expression Language) injection that is evaluated server-side (CWE-94). An unauthenticated attacker who can reach the Nutch REST API can send crafted requests whose injected expressions are executed by the server, gaining remote code execution in the context of the Nutch process. All Apache Nutch releases from 1.11 through 1.22 are affected when the Nutch Server is running; version 1.23 resolves the issue by removing the Nutch Server entirely. No CVSS score has been assigned yet, the flaw is not in CISA's KEV, and no public proof-of-concept or confirmed in-the-wild exploitation is known.
  · Apache Nutch (Nutch Server / Nutch REST API) 1.11 through 1.22 (inclusive); fixed in 1.23, which removes the Nutch Serverniche
• CVE-2026-803548.1—
  Cross-Tenant Secret Exposure via Authorization Bypass in Apache Camel K
  Apache Camel K, the Kubernetes-native integration runtime for Apache Camel, has an authorization flaw (CWE-639, user-controlled key) in its custom resource resolution: tenant-supplied values, such as the Builder trait's mavenProfiles ValueSources, cause the operator to resolve secrets by name from the operator's namespace instead of the tenant's own namespace. A tenant that can set a secret name on an Integration build resource can therefore have the operator pull in a secret belonging to another tenant or to operator components. An attacker with tenant-level access gains access to those secrets, potentially obtaining credentials shared across the multi-tenant cluster. Users running Apache Camel K 2.0.0 through 2.9.2 or version 2.10.1 are affected; fixes are available in 2.9.3, 2.10.2, and 2.11.0. No public proof of concept exists, the issue is not in CISA KEV, and no in-the-wild exploitation is known.
  · Apache Camel K >= 2.0.0 and < 2.9.3 (fixed in 2.9.3) · Apache Camel K 2.10.1 (fixed in 2.10.2); 2.11.0 is unaffectedniche
• CVE-2026-493627.5<1%
  Unauthenticated Queue Creation in Apache ActiveMQ Artemis CORE Protocol
  CVE-2026-49362 is a missing-authentication flaw (CWE-306) in the CORE protocol handler of Apache ActiveMQ Artemis and Apache Artemis: the broker accepts CORE protocol commands without requiring any credentials. A remote attacker with network access to the broker's CORE acceptor (the default messaging port) can create arbitrary durable queues without authenticating, manipulating broker state without authorization. Because durable queues persist and consume broker resources, an attacker can repeatedly create queues to exhaust storage or memory and cause a denial of service; the queue creation itself also corrupts the intended broker configuration. All Apache ActiveMQ Artemis versions 1.0.0 through 2.44.0 and Apache Artemis versions 2.50.0 through 2.56.0 are affected. There is no CVSS score yet, no public proof-of-concept, and no known exploitation in the wild; the fix is available in version 2.57.0.
  · Apache ActiveMQ Artemis 1.0.0 through 2.44.0 (inclusive) · Apache Artemis 2.50.0 through 2.56.0 (inclusive)large
• CVE-2026-672117.5—
  OOM Denial of Service in Apache OpenNLP opennlp-spellcheck 3.0.0-M4/M5
  Apache OpenNLP's opennlp-spellcheck extension, introduced in 3.0.0-M4 and present in 3.0.0-M5, contains a flaw in SymSpellModelSerializer.create(): the unigramCount and bigramCount 32-bit integers read from a binary SymSpell model stream are passed directly to LinkedHashMap.newLinkedHashMap() with only a non-negative check and no upper bound. An attacker who controls a .bin model file sets either count to Integer.MAX_VALUE (or any heap-exhausting value), causing the map to be pre-sized to 2^30 entries and a 4-8 GB backing array to be allocated on the first put(), crashing the JVM with an OutOfMemoryError; a malicious file of well under 100 bytes plus a single real entry is sufficient. The attacker gains denial of service against any process that deserializes the crafted model, via paths including SymSpellModels.deserialize(InputStream), SymSpellModels.fromBytes(byte[]), classpath loading through SymSpellModelResolver.resolveByLanguage(String), the CorrectTextTool command-line tool, and model-archive loading through the registered ArtifactSerializer. Users running OpenNLP 3.0.0-M4 or 3.0.0-M5 who load SymSpell models from untrusted or semi-trusted origins are affected; OpenNLP 1.x and 2.x releases do not contain the vulnerable code. No public proof-of-concept is known, the issue is not on the CISA KEV list, CVSS scoring is pending, and no in-the-wild exploitation has been reported.
  · Apache OpenNLP opennlp-spellcheck extension 3.0.0-M4, 3.0.0-M5niche
• CVE-2026-499757.534%
  Unauthenticated DoS via excessive memory allocation in Apache HTTP Server (HTTP/2 'bomb')
  CVE-2026-49975 is a memory-allocation flaw (CWE-789, 'Memory Allocation with Excessive Size Value', with related data-amplification handling per CWE-409) in Apache HTTP Server's mod_http module; related press coverage characterizes it as an HTTP/2 'bomb'. An unauthenticated remote attacker triggers it by sending malicious HTTP requests that cause the server to allocate memory with an excessively large size, and the practical impact is denial of service — availability loss with no direct confidentiality or integrity impact (CVSS 7.5, AV:N/AC:L/PR:N/UI:N, availability impact high). It affects Apache HTTP Server 2.4.17 through 2.4.67, and the advisory data also lists Debian Linux as affected through its shipped Apache packages (specific Debian releases are not specified). Exploitation has not been confirmed in the wild and the flaw is not in CISA's KEV catalog, but a public proof-of-concept exists (github.com/EQSTLab/CVE-2026-49975) and EPSS assigns a 31% probability of exploitation within 30 days (98th percentile), so near-term exploitation is plausible.
  · apache http server 2.4.17 through 2.4.67 (inclusive) · debian linux PoC mass
• CVE-2026-782547.4<1%
  Path Traversal in Apache Ant ftp and scp Tasks Allows Arbitrary File Write
  CVE-2026-78254 is a path traversal flaw (CWE-23) in the ftp and scp download tasks of Apache Ant: in versions prior to 1.10.18, a server providing downloaded files can use relative paths to write outside the dedicated destination directory. It is triggered when an Ant build uses the ftp or scp task to fetch files from a malicious server, or via a machine-in-the-middle attack against plain ftp; for scp and ftps, the attacking server must still pass the tasks' server identity checks. A successful attack lets the attacker overwrite files of their choosing on the machine running the build, using the permissions of the user executing Ant, potentially tampering with scripts, libraries, or build outputs. Affected users are those running Apache Ant builds (before 1.10.18) that download files with the ftp or scp tasks, especially against servers that are not fully trusted or are reached over untrusted networks. No exploitation is currently known: there is no public proof-of-concept, the flaw is not in CISA's KEV, and EPSS estimates only a 0.4% probability of exploitation within 30 days.
  · Apache Ant all versions prior to 1.10.18—
• CVE-2026-578226.5<1%
  Authenticated deserialization DoS in Apache ActiveMQ Artemis brokers
  When an Apache Artemis or Apache ActiveMQ Artemis broker processes message-based management requests, it deserializes certain method parameters—including ones the broker does not actually use—and the permitted types can be abused to craft a payload that forces excessive computation, pinning the processing thread and causing a denial of service. Triggering the flaw requires an authenticated messaging client that is authorized with the MANAGE permission to perform management-via-messaging, so anonymous or unprivileged clients cannot exploit it. An attacker with such access can repeatedly submit crafted management messages to tie up broker processing capacity, degrading or blocking message handling. Affected deployments run Apache ActiveMQ Artemis 1.3.0 through 2.44.0 or Apache Artemis 2.50.0 through 2.56.0; the fix ships in version 2.57.0. No public proof-of-concept or in-the-wild exploitation is known, and the issue has not yet been scored under CVSS.
  · Apache Artemis 2.50.0 through 2.56.0 · Apache ActiveMQ Artemis 1.3.0 through 2.44.0large

Appears with