Ubuntu issues USN-8571-2 fixing an Apache HTTP Server regression that prevented startup when HTTP/2 proxying was enabled.
Ubuntu released USN-8571-2 to fix a regression introduced by USN-8571-1 in Apache HTTP Server. The earlier fix was incomplete due to a missing library symbol, causing Apache to fail to start when HTTP/2 proxying was enabled. The original advisory addressed CVE-2026-33007, a memory-handling flaw in mod_authn_socache allowing remote denial of service, and an HTTP response splitting vulnerability affecting multiple modules, credited to Pavel Kohout, Arkadi Vainbrand, Haruki Oyama, Merih Mengisteab, and Dawit Jeong.
CISA added CVE-2026-34486, an actively exploited Apache Tomcat EncryptInterceptor bypass enabling unauthenticated deserialization RCE, to its KEV catalog.
CVE-2026-34486 allows bypass of Apache Tomcat's EncryptInterceptor, a flaw introduced by the fix for padding-oracle issue CVE-2026-29146 in Tribes cluster encryption. CISA added the flaw to the Known Exploited Vulnerability catalog on August 4, 2026, alongside actively exploited Langflow and N-central flaws, with remediation required under BOD 26-04 guidance. Official patches and workarounds are available, and reporting notes unauthenticated remote code execution through Java deserialization on the Tribes receiver port 4000.
Technical analysis shows CVE-2026-34486 is a one-line fail-open regression in Tomcat Tribes enabling unauthenticated RCE via Java deserialization.
CVE-2026-34486 is a fail-open regression in Tomcat's Tribes EncryptInterceptor, introduced while fixing the CVE-2026-29146 padding-oracle flaw; Apache rated it Important and NVD scores it 7.5 High. Decryption failures are now forwarded to an unfiltered ObjectInputStream, and public PoC repositories demonstrate unauthenticated RCE on default port 4000 when clustering, the EncryptInterceptor, a reachable receiver and deserialization gadgets are all present. Affected releases 9.0.116, 10.1.53 and 11.0.20 are fixed in 9.0.117, 10.1.54 and 11.0.21; Tomcat 8.5 is unaffected.
SentinelOne details CVE-2026-34486, an Apache Tomcat EncryptInterceptor bypass exposing unencrypted cluster communications, with patches and workarounds available.
CVE-2026-34486 stems from an incomplete fix for CVE-2026-29146, letting network-positioned attackers bypass the EncryptInterceptor and read plaintext Tomcat cluster traffic, including session and application data between nodes. Affected versions 9.0.116, 10.1.53 and 11.0.20 are fixed in 9.0.117, 10.1.54 and 11.0.21. Workarounds include network-level encryption such as IPsec or VPN tunnels and isolating cluster communications to secured network segments.
Apache ActiveMQ CVE-2026-74761: moderate clientId spoofing in RemoveSubscription handling, affecting Broker, All and apache-activemq, fixed in 6.3.2 and 5.19.11.
The Apache ActiveMQ team disclosed CVE-2026-74761, a moderate-severity spoofing issue in the handling of RemoveSubscription clientId. Affected components include ActiveMQ Broker (activemq-broker), ActiveMQ All (activemq-all) and Apache ActiveMQ in versions 6.0.0 before 6.3.2 and 5.x before 5.19.11. The flaw could allow a client to spoof another client's clientId when removing subscriptions. Users should upgrade to the 6.3.2 or 5.19.11 release lines or later.
Apache Parquet Hadoop CVE-2026-73334: a file-controlled KMS URL reaches pluggable KmsClients without host validation in parquet-java 1.12 through 1.18.0.
Apache disclosed CVE-2026-73334, a moderate issue in the org.apache.parquet.crypto.keytools package of parquet-java, versions 1.12 through 1.18.0. The package implements envelope encryption that wraps data keys via a Key Management Service. A KMS URL controlled by the Parquet file is forwarded to a pluggable KmsClient that skips host validation, which could allow crafted files to redirect KMS requests.
Apache fixed CVE-2026-41871, an unauthenticated unsafe-reflection job execution flaw in Nutch Server's REST API affecting versions 1.10-1.22.
CVE-2026-41871 describes a Missing Authorization and Unsafe Reflection vulnerability in Apache Nutch Server (the Nutch REST API), rated important by Apache. Affected versions are Apache Nutch 1.10 through 1.22, allowing unauthenticated reflection-based job execution via externally controlled class selection. Users are recommended to upgrade to version 1.23, which removes the Nutch Server; users who cannot upgrade must apply mitigations.
Apache fixed CVE-2026-41870, a critical unauthenticated RCE via JEXL injection in Nutch Server's REST API affecting versions 1.11-1.22.
CVE-2026-41870 describes a critical Missing Authorization and Code Injection vulnerability in Apache Nutch Server (the Nutch REST API), enabling unauthenticated remote code execution via JEXL injection. Affected versions are Apache Nutch 1.11 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server; users who cannot upgrade must apply mitigations.
Apache Ant 1.2 before 1.10.18 ftp and scp tasks allow path traversal, letting malicious servers overwrite arbitrary files (CVE-2026-78254).
CVE-2026-78254 affects Apache Ant (org.apache.ant:ant) versions 1.2 before 1.10.18 and is rated moderate. The ftp and scp tasks download files from a remote server, and a malicious server can supply relative paths that write outside the dedicated target directory, overwriting attacker-chosen files with the permissions of the user running Ant. The issue is fixed in Apache Ant 1.10.18.
Fortinet advisory details CVE-2026-49975, an Apache HTTP Server HTTP/2 flaw enabling denial of service, affecting versions 2.4.17 through 2.4.67.
Fortinet PSIRT advisory FG-IR-26-163, revised 2026-08-19, covers CVE-2026-49975, a memory allocation with excessive size value flaw (HTTP/2 bomb) in Apache HTTP Server's mod_http2, scored CVSSv3 5.8. Malicious HTTP requests can cause a denial of service, and affected versions span Apache HTTP Server 2.4.17 through 2.4.67. The advisory text does not state which Fortinet product bundles the affected Apache component or whether exploitation has been observed.
EncryptInterceptor Bypass Exposes Cluster Traffic in Apache Tomcat
CVE-2026-34486 is a missing-encryption vulnerability in Apache Tomcat in which the EncryptInterceptor, the component that encrypts Tomcat cluster communication, can be bypassed in a fail-open manner; the flaw was introduced as a regression by the fix for CVE-2026-29146. It affects Tomcat 11.0.20, 10.1.53 and 9.0.116, and is triggered when cluster communication is expected to be encrypted: an attacker positioned on the network path between cluster nodes receives inter-node traffic in cleartext. By reading that unencrypted traffic, the attacker can obtain sensitive data such as session payloads, potentially enabling session theft and authentication bypass as indicated by related reporting. Only deployments running the affected point releases with the EncryptInterceptor in use are impacted, including Tomcat shipped in Red Hat JBoss Web Server and Red Hat Enterprise Linux channels. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-04, EPSS places 30-day exploitation probability at 98.6%, though no public proof-of-concept is known and ransomware use is unconfirmed.
· Apache Tomcat 11.0.20, 10.1.53, 9.0.116 (fixed in 11.0.21, 10.1.54, 9.0.117) · Red Hat JBoss Web Server (ships affected Tomcat) KEVlarge
Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration.
Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.
Unauthenticated reflection-based job execution in Apache Nutch Server REST API
CVE-2026-41871 is a missing-authorization flaw (CWE-862) combined with unsafe reflection (CWE-470) in the Nutch Server component, i.e., the Nutch REST API, affecting Apache Nutch versions 1.10 through 1.22. The REST API fails to properly authorize requests, so unauthenticated or untrusted users can send API calls whose externally controlled input determines which classes or code are loaded and executed. An attacker who can reach the exposed Nutch Server can therefore trigger reflection-based job execution, potentially running arbitrary classes or jobs on the server. Only deployments running the optional Nutch Server (REST API) on Nutch 1.10 through 1.22 are affected. There is currently no public proof of concept, no known in-the-wild exploitation, and the issue is not in CISA KEV; the CVSS score has not yet been assigned.
· Apache Nutch (Nutch Server / Nutch REST API) 1.10 through 1.22; fixed in 1.23, which removes the Nutch Serverniche
Unauthenticated RCE via JEXL injection in Apache Nutch REST API
The Nutch Server component of Apache Nutch (its REST API) fails to require authorization for requests (CWE-862) and allows externally controlled input to select classes and dynamically managed code resources (CWE-470, CWE-913), culminating in JEXL (Java Expression Language) injection that is evaluated server-side (CWE-94). An unauthenticated attacker who can reach the Nutch REST API can send crafted requests whose injected expressions are executed by the server, gaining remote code execution in the context of the Nutch process. All Apache Nutch releases from 1.11 through 1.22 are affected when the Nutch Server is running; version 1.23 resolves the issue by removing the Nutch Server entirely. No CVSS score has been assigned yet, the flaw is not in CISA's KEV, and no public proof-of-concept or confirmed in-the-wild exploitation is known.
· Apache Nutch (Nutch Server / Nutch REST API) 1.11 through 1.22 (inclusive); fixed in 1.23, which removes the Nutch Serverniche
Improper Input Validation in Apache Parquet leaks KMS tokens via file-controlled KMS URL
CVE-2026-73334 is an improper input validation flaw (CWE-20) in the org.apache.parquet.crypto.keytools package of Apache Parquet, versions 1.12 through 1.18, which implements envelope encryption of Parquet files with data keys wrapped via a Key Management Service. The flaw is triggered when a reader does not application-control the KMS URL parameter, causing the KMS URL embedded in the Parquet file itself to be forwarded to a pluggable KmsClient implementation; if that client does not validate the destination host, the KMS token is sent to a malicious host specified by the attacker inside the file. An attacker who can supply or tamper with a Parquet file read under this configuration can capture the KMS token, potentially exposing key-management credentials and enabling unauthorized access to encrypted data keys — this is a credential/secret exposure issue, not remote code execution. Users of Parquet's envelope-encryption feature who rely on file-controlled KMS URLs with custom KmsClient plugins lacking host validation are affected; readers that set the KMS URL via application control are not exposed. The issue has not yet received a CVSS score, is not in CISA KEV, has no known public proof-of-concept, and there is no known exploitation in the wild; a fix is expected in version 1.19, which will disable file-controlled KMS URLs by default.
· Apache Parquet (Hadoop) — org.apache.parquet.crypto.keytools 1.12 to 1.18 (fix expected in 1.19 per the disclosure)large
Improper input validation in Apache ActiveMQ allows clientId spoofing
Apache ActiveMQ contains an improper input validation flaw (CWE-20) in the TopicRegion component that manages durable topic subscriptions, affecting all platforms. An authenticated client can spoof another client's clientId when sending a remove-subscription request, causing the broker to delete a durable topic subscription that belongs to a different client. An attacker with valid broker credentials can thereby disrupt other clients' message delivery, since removing a durable subscription can make affected subscribers stop receiving topic messages; the issue is a spoofing/integrity and limited-availability problem, not remote code execution. Users of any of the three distributions (Apache ActiveMQ, ActiveMQ Broker, ActiveMQ All) on versions before 5.19.11 or 6.x from 6.0.0 before 6.3.2 are affected, particularly deployments that accept connections from third-party or multi-tenant authenticated clients. No public proof-of-concept or in-the-wild exploitation is known, the issue is not in CISA KEV, and CVSS scoring is still pending.
· Apache ActiveMQ before 5.19.11; from 6.0.0 before 6.3.2 (fixed in 5.19.11 or 6.3.2) · Apache ActiveMQ Broker before 5.19.11; from 6.0.0 before 6.3.2 (fixed in 5.19.11 or 6.3.2)large
Unauthenticated DoS via excessive memory allocation in Apache HTTP Server (HTTP/2 'bomb')
CVE-2026-49975 is a memory-allocation flaw (CWE-789, 'Memory Allocation with Excessive Size Value', with related data-amplification handling per CWE-409) in Apache HTTP Server's mod_http module; related press coverage characterizes it as an HTTP/2 'bomb'. An unauthenticated remote attacker triggers it by sending malicious HTTP requests that cause the server to allocate memory with an excessively large size, and the practical impact is denial of service — availability loss with no direct confidentiality or integrity impact (CVSS 7.5, AV:N/AC:L/PR:N/UI:N, availability impact high). It affects Apache HTTP Server 2.4.17 through 2.4.67, and the advisory data also lists Debian Linux as affected through its shipped Apache packages (specific Debian releases are not specified). Exploitation has not been confirmed in the wild and the flaw is not in CISA's KEV catalog, but a public proof-of-concept exists (github.com/EQSTLab/CVE-2026-49975) and EPSS assigns a 31% probability of exploitation within 30 days (98th percentile), so near-term exploitation is plausible.
· apache http server 2.4.17 through 2.4.67 (inclusive) · debian linux PoC mass
Path Traversal in Apache Ant ftp and scp Tasks Allows Arbitrary File Write
CVE-2026-78254 is a path traversal flaw (CWE-23) in the ftp and scp download tasks of Apache Ant: in versions prior to 1.10.18, a server providing downloaded files can use relative paths to write outside the dedicated destination directory. It is triggered when an Ant build uses the ftp or scp task to fetch files from a malicious server, or via a machine-in-the-middle attack against plain ftp; for scp and ftps, the attacking server must still pass the tasks' server identity checks. A successful attack lets the attacker overwrite files of their choosing on the machine running the build, using the permissions of the user executing Ant, potentially tampering with scripts, libraries, or build outputs. Affected users are those running Apache Ant builds (before 1.10.18) that download files with the ftp or scp tasks, especially against servers that are not fully trusted or are reached over untrusted networks. No exploitation is currently known: there is no public proof-of-concept, the flaw is not in CISA's KEV, and EPSS estimates only a 0.4% probability of exploitation within 30 days.
A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and earlier allows an unauthenticated remote user to crash a child process in a
A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and earlier allows an unauthenticated remote user to crash a child process in a caching forward proxy configuration. Users are recommended to upgrade to version 2.4.67, which fixes this issue.
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.