Apache security advisories, April 2026

Every Apache Software Foundation security advisory published in April 2026, from ASF Security ([email protected] CNA) via NVD, with its severity, CVEs and CISA KEV status. Open a record for affected and fixed versions and the vendor's own link.

Advisories: 86
Critical: 11
High: 43
In CISA KEV: 3
CVEs: 98

Apache advisories published in April 2026

Apr 30, 2026
Medium [CVE-2026-41016] Apache Airflow's SMTP provider `SmtpHook` called Python's `smtplib.SMTP.starttls` without an SSL context, so no certificate…
Medium5.9
Apr 28, 2026
Critical [CVE-2026-41873] ** UNSUPPORTED WHEN ASSIGNED ** Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability…
Critical9.8
Apr 28, 2026
High [CVE-2026-41636] Apache Thrift: Node.js skip recursion
High8.7
Apr 28, 2026
High [CVE-2026-41605] Apache Thrift: Swift Compact Protocol integer overflow
High7.3
Apr 28, 2026
High [CVE-2026-41604] Apache Thrift: Swift Range crash in skip
High8.2
Apr 28, 2026
High [CVE-2026-41603] Apache Thrift: Java TSSLTransportFactory hostname verification
High7.4
Apr 28, 2026
High [CVE-2026-41602] Apache Thrift: Go TFramedTransport uint32 overflow
High7.5
Apr 28, 2026
High [CVE-2025-48431] Apache Thrift: Specially crafted input can crash a c_glib Thrift server with invalid pointer error.
High7.5
Apr 28, 2026
Medium [CVE-2026-41607] Apache Thrift: C++ JSON OOB read
Medium6.5
Apr 28, 2026
Medium [CVE-2026-41606] Apache Thrift: c_glib dispatch stack overflow
Medium5.3
Apr 27, 2026
Critical [CVE-2026-33453] Apache Camel: CoAP URI Query Parameter to Exchange Header Injection in camel-coap Allows Single-Packet Pre-Auth Remote Code Execution
Critical10.0
Apr 27, 2026
Critical [CVE-2024-52046 +1] Apache MINA AbstractIoBuffer: The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject was incomplete.
Critical9.8
Apr 27, 2026
Critical [CVE-2025-27636 +3] Apache Camel: Inbound Header Filter Missing in MailHeaderFilterStrategy Allows Remote Code Execution via MIME Header Injection (CVE-2025-30177 Variant)
Critical9.4
Apr 27, 2026
Critical [CVE-2026-41635] Apache MINA's AbstractIoBuffer.resolveClass contains two branches, one of them (for static classes or primitive types) does…
Critical9.8
Apr 27, 2026
Critical [CVE-2026-40860] Apache Camel: Unsafe Deserialization of JMS ObjectMessage in camel-jms, camel-sjms, camel-sjms2 and camel-amqp
Critical9.8
Apr 27, 2026
Critical [CVE-2025-27636 +1] Apache Camel: The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such as…
Critical9.9
Apr 27, 2026
High [CVE-2024-22369 +3] Apache Camel: Unsafe Java deserialization in camel-consul ConsulRegistry allows arbitrary code execution via malicious values read from the Consul KV store
High8.8
Apr 27, 2026
High [CVE-2024-22369 +3] Apache Camel: Camel-Infinispan: Unsafe Deserialization in Remote Aggregation Repository
High8.8
Apr 27, 2026
High [CVE-2026-40022] Apache Camel Platform HTTP Main: Authentication Bypass on Non-Root Context Paths in camel main runtime
High8.2
Apr 27, 2026
High [CVE-2026-40473] Apache Camel: The camel-mina component's MinaConverter.toObjectInput(IoBuffer) type converter wraps an IoBuffer in a java.io.ObjectInputStream…
High8.8
Apr 27, 2026
High [CVE-2026-40048] Apache Camel PQC: Unsafe Deserialization from FileBasedKeyLifecycleManager
High7.8
Apr 27, 2026
Medium [CVE-2026-41081] Improper Handling of TLS Client Authentication Failure Leading to Anonymous Principal Assignment in Apache Storm Versions…
Medium6.5
Apr 27, 2026
Medium [CVE-2026-40557] Apache Storm Prometheus: Improper Certificate Validation
Medium4.8
Apr 24, 2026
High [CVE-2026-23902] Incorrect Authorization vulnerability in Apache DolphinScheduler
High8.1
Apr 24, 2026
High [CVE-2026-41044] Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE via DestinationView MBean exposed by Jolokia
High8.8
Apr 24, 2026
High [CVE-2026-34197 +1] Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker…
High8.8ExploitedCISA KEV
Apr 24, 2026
Medium [CVE-2026-40690] Apache Airflow: Assets graph view bypasses DAG level access control displaying unrelated topologies and all DAGs names to unauthorized users
Medium4.3
Apr 24, 2026
Medium [CVE-2026-38743] Apache Airflow: Dags endpoint might provide access to otherwise inaccessible entities
Medium4.3
Apr 24, 2026
Medium [CVE-2026-41043] Apache ActiveMQ Web: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache ActiveMQ, Apache ActiveMQ…
Medium6.5
Apr 24, 2026
Medium [CVE-2025-62233] Apache DolphinScheduler: Deserialization of Untrusted Data vulnerability in Apache DolphinScheduler RPC module.
Medium6.3
Apr 22, 2026
High [CVE-2026-40542] Apache HttpClient: SCRAM-SHA-256 mutual authentication bypass may cause the client to accept authentication without proper mutual authentication verification
High7.3
Apr 20, 2026
Critical [CVE-2026-33557] Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication
Critical9.1
Apr 20, 2026
Medium [CVE-2026-33558] Apache Kafka: Information exposure vulnerability has been identified in Apache Kafka.
Medium5.3
Apr 20, 2026
Medium [CVE-2025-66335] Apache Doris MCP Server versions earlier than 0.6.1 are affected by an improper neutralization flaw in query context handling
Medium5.3
Apr 18, 2026
High [CVE-2026-32228] Apache Airflow: Users with asset materialization permisssions could trigger Dags they had no access to
High7.5
Apr 18, 2026
High [CVE-2026-30912] Apache Airflow: Exposing stack trace in case of constraint error
High7.5
Apr 18, 2026
High [CVE-2026-30898] Apache Airflow: Bad example of BashOperator shell injection via dag_run.conf
High8.8
Apr 18, 2026
High [CVE-2026-25917] Apache Airflow: API extra-links triggers XCom deserialization/class instantiation (Airflow 3.1.5)
High7.2
Apr 18, 2026
Medium [CVE-2026-40948] The Keycloak authentication manager in `apache-airflow-providers-keycloak` did not generate or validate the OAuth 2.0 `state`…
Medium5.4
Apr 18, 2026
Low [CVE-2026-32690] Apache Airflow: 3.x - Nested Variable Secret Values Bypass Redaction via max_depth=1
Low3.7
Apr 16, 2026
High [CVE-2026-31987] Apache Airflow: JWT token appearing in logs
High7.5
Apr 15, 2026
High [CVE-2026-30778] Apache SkyWalking: The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL.
High7.5
Apr 15, 2026
High [CVE-2025-54550] Apache Airflow: RCE by race condition in example_xcom dag
High8.1
Apr 15, 2026
Medium [CVE-2026-25219] Apache Airflow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view access
Medium6.5
Apr 14, 2026
Critical [CVE-2026-31908] Apache APISIX: Header injection vulnerability in Apache APISIX.
Critical9.1
Apr 14, 2026
High [CVE-2026-31923] Apache APISIX: Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX.
High7.5
Apr 14, 2026
Medium [CVE-2026-23907 +1] Apache PDFBox Examples: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples.
Medium4.3
Apr 14, 2026
Medium [CVE-2026-31924] Apache APISIX: Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX.
Medium5.3
Apr 13, 2026
High [CVE-2026-33858] Apache Airflow: Unsafe Deserialization via Legacy Serialization Keys (__type/__var) Bypass in XCom API
High8.8
Apr 13, 2026
High [CVE-2025-66236] Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UI
High7.5
Apr 13, 2026
High [CVE-2026-34476] Apache SkyWalking MCP: Server-Side Request Forgery via SW-URL Header vulnerability in Apache SkyWalking MCP.
High7.1
Apr 13, 2026
High [CVE-2026-35337] Apache Storm: Deserialization of Untrusted Data vulnerability in Apache Storm.
High8.8
Apr 13, 2026
Medium [CVE-2026-35565] Apache Storm UI: Stored Cross-Site Scripting (XSS)
Medium5.4
Apr 10, 2026
High [CVE-2026-39304] Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incorrect handling of TLSv1.3 KeyUpdate can be exploited to cause DoS via OOM
High7.5
Apr 10, 2026
Medium [CVE-2026-40023] Apache Log4cxx's XMLLayout https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html , in versions before…
Medium6.3
Apr 10, 2026
Medium [CVE-2026-40021] Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and…
Medium6.3
Apr 10, 2026
Medium [CVE-2026-34481] Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions up to and…
Medium6.3
Apr 10, 2026
Medium [CVE-2026-34480] Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and…
Medium6.9
Apr 10, 2026
Medium [CVE-2026-34479] The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard…
Medium6.9
Apr 10, 2026
Medium [CVE-2026-34478] Apache Log4j Core's Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , in versions 2.21.0…
Medium6.9
Apr 10, 2026
Medium [CVE-2025-68161 +1] Apache Log4j: The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname…
Medium6.3
Apr 9, 2026
Critical [CVE-2026-29145] Apache Tomcat: CLIENT_CERT authentication does not fail as expected for some scenarios
Critical9.1
Apr 9, 2026
Critical [CVE-2025-57735] Apache Airflow: Airflow Logout Not Invalidating JWT
Critical9.1
Apr 9, 2026
High [CVE-2026-34487] Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat…
High7.5
Apr 9, 2026
High [CVE-2026-29146 +1] Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor
High7.5ExploitedCISA KEV
Apr 9, 2026
High [CVE-2026-34483] Apache Tomcat: Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat.
High7.5
Apr 9, 2026
High [CVE-2026-29146] Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default
High7.5
Apr 9, 2026
High [CVE-2026-29129] Apache Tomcat: Configured cipher preference order not preserved vulnerability in Apache Tomcat.
High7.5
Apr 9, 2026
High [CVE-2026-24880] Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat
High7.5
Apr 9, 2026
High [CVE-2025-66168 +1] Apache ActiveMQ: Integer Overflow or Wraparound vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ MQTT.
High7.5
Apr 9, 2026
High [CVE-2026-34020] Apache OpenMeetings: Use of GET Request Method With Sensitive Query Strings vulnerability in Apache OpenMeetings.
High7.5
Apr 9, 2026
High [CVE-2026-33266] Apache OpenMeetings: Use of Hard-coded Cryptographic Key vulnerability in Apache OpenMeetings.
High7.5
Apr 9, 2026
High [CVE-2023-48796 +1] Apache DolphinScheduler: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Apache DolphinScheduler.
High7.5
Apr 9, 2026
Medium [CVE-2026-34500] Apache Tomcat: CLIENT_CERT authentication does not fail as expected for some scenarios
Medium6.5
Apr 9, 2026
Medium [CVE-2025-66614 +1] Apache Tomcat: Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614.
Medium5.3
Apr 9, 2026
Medium [CVE-2026-25854] Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve
Medium6.1
Apr 9, 2026
Medium [CVE-2026-33005] Apache OpenMeetings: Improper Handling of Insufficient Privileges vulnerability in Apache OpenMeetings.
Medium4.3
Apr 9, 2026
Medium [CVE-2026-34538] Apache Airflow: Authorization bypass in DagRun wait endpoint (XCom exposure)
Medium6.5
Apr 7, 2026
High [CVE-2026-27314] Privilege escalation in Apache Cassandra 5.0 on an mTLS environment using MutualTlsAuthenticator
High8.8
Apr 7, 2026
High [CVE-2026-35554] race condition in the Apache Kafka Java producer client’s buffer pool management
High8.7
Apr 7, 2026
High [CVE-2026-34197] Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans
High8.8ExploitedCISA KEV
Apr 7, 2026
Medium [CVE-2026-32588] Authenticated DoS over CQL in Apache Cassandra 4.0, 4.1, 5.0 allows authenticated user to raise query latencies
Medium6.5
Apr 7, 2026
Medium [CVE-2026-27315] Sensitive Information Leak in cqlsh in Apache Cassandra 4.0
Medium5.5
Apr 7, 2026
Medium [CVE-2026-33227] Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker…
Medium4.3
Apr 2, 2026
High [CVE-2025-65114] Apache Traffic Server: Apache Traffic Server allows request smuggling if chunked messages are malformed.
High7.5
Apr 2, 2026
High [CVE-2025-58136] Apache Traffic Server: bug in POST request handling causes a crash under a certain condition.
High7.5

Get an email when Apache publishes the next one.

See Apache's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about Apache

Dates are each advisory's publication date at the source, in UTC; a record with no source date is filed under the day VulniPulse first saw it.