Apache XML Graphics FOP unsafe deserialization in hyphenation loading (CVE-2026-71395)
Apache rates the flaw moderate; the notice gives no affected versions, fix, or exploitation status.
Stories per day · 30 days
14 RSS
Relateddenial-of-service8axis27apache-kylin6authorization6information-disclosure6james5oss-security5zookeeper5acl4apache-answer4couchdb4deserialization4dos4qpid-proton4ssrf4xxe4airflow3amqp3
144 stories, newest first · one card per story
Stories tagged #apache
Apache HTTP Server mod_http2 heap bug can yield RCE (CVE-2026-119618)
The advisory rates the assign_headers race critical and also covers mod_h2 2.0.8 through 2.0.42.
Apache Roller 6.1.7 fixes 15 security issues, including XXE
The Apache Roller PMC published 15 advisories on November 11, 2026, with fixes in release 6.1.7.
DataSketches Java through 9.0.0 can exhaust memory on crafted input
Deserializers trusted sizes in serialized sketch images, so a small input could trigger an OutOfMemoryError.
Ubuntu warns of Apache HTTP Server DoS and cookie leak
CVE-2026-46729 affects Ubuntu 14.04 LTS through 26.04 LTS; the snippet states no fixed versions.
ModSecurity discloses upload-bypass and crash flaws, one unpatched
One flaw has no listed fix; the pointer bug is reachable only if SecParseXmlIntoArgs is On or OnlyArgs.
Apache Airflow logout token revocation fails open
Apache Airflow logout endpoint fails to revoke tokens when errors occur during server-side revocation.
Apache Airflow secrets masker bounded at depth 5
Apache Airflow secrets masker stops descending into nested structures after five levels, exposing deeply-nested registered secrets in task logs.
Apache Allura OAuth1 rebinding vulnerability disclosed (CVE-2026-118196)
Apache Allura rebinding issue rated critical; details at allura.apache.org.
Apache Axis2/Java SSRF via WSDL/XSD schema import resolution
Apache Axis2/Java before 2.0.2 allows SSRF when building service descriptions from WSDL through unrestricted fetching of absolute URLs in wsdl:import and xsd:import/include locations.
CVE-2026-49939: Apache James JMAP ACL bypass
JMAP protocol fails to respect negative IMAP ACL rules, letting users administer folders despite denials; upgrade to 3.9.1 required.
Apache James ManageSieve path traversal vulnerability
Apache James before 3.9.1 allows cross-user path traversal in ManageSieve file implementation, enabling arbitrary SIEVE scripts.
Apache James WebAdmin exposed without authentication on official Docker default (CVE-2026-74756)
WebAdmin is exposed without authentication in the official Docker image for Apache James.
Apache James: SASL OAUTHBEARER do not validate aud in JWT payload if misconfigured (CVE-2025-66621)
SASL OAuthBearer fails to validate AUD claim in JWT payload when not configured.
Apache Sling Engine before 3.0.4 vulnerable to HTTP request smuggling (CVE-2026-103866)
Apache Sling Engine before 3.0.4 allows HTTP request smuggling by accepting non-standard percent-escapes.
Apache Struts2 Tiles Plugin has cache vulnerabilities in versions 6.3.0 and 7.4.0
Unsynchronized unbounded caches in Apache Struts2 Tiles plugin can lead to corrupted cache entries and infinite loops under load.
Apache OFBiz 24.09.08 patches multiple critical vulnerabilities
Multiple critical issues in Apache OFBiz before 24.09.08 have been fixed by upgrading to 24.09.08.
Apache Juneau 9.2.1 fixes multiple vulnerabilities
Apache Juneau 9.2.1, released November 3, addresses multiple CVEs including CVE-2026-73095.
Apache ActiveMQ retains write access after ACL revocation
Cached authorization flaw allows continued write access after live ACL removal in versions before 6.3.3.
Apache ActiveMQ NMS OpenWire Client Library DoS via unbounded length fields (CVE-2026-103582)
The .NET OpenWire client before 2.3.0 allows remote denial of service by unvalidated frame sizes in unmarshalling.
Apache ZooKeeper vulnerable to unbounded recursion in snapshot serialization (CVE-2026-115448)
A client can cause the server to become unrecoverable by creating znodes due to no depth limit in recursion.
Apache ZooKeeper ACL enforcement bypass allows unauthorized operations
TOCTOU race condition in setACL request handling allows unauthorized operations to commit after an ACL revocation in versions 3.9.0 through 3.9.6 and 3.8.0 through 3.8.7.
Apache Juneau 9.2.1 fixes multiple vulnerabilities
Apache Juneau 9.2.1, released on 2026-11-03, fixes multiple vulnerabilities with upgrade recommended.
Apache Traffic Server heap-buffer-overflow via HTTP Host header
90-day disclosure of heap-buffer-overflow in Apache Traffic Server master branch due to unbounded alloca in HttpTransact.cc.