Apache security advisories, June 2026

Every Apache Software Foundation security advisory published in June 2026, from ASF Security ([email protected] CNA) via NVD, with its severity, CVEs and CISA KEV status. Open a record for affected and fixed versions and the vendor's own link.

Advisories: 45
Critical: 0
High: 8
In CISA KEV: 0
CVEs: 47

Apache advisories published in June 2026

Jun 30, 2026
High [CVE-2026-54475] Apache ActiveMQ: Missing Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.
High7.5
Jun 30, 2026
High [CVE-2026-53917] Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client…
High7.5
Jun 30, 2026
High [CVE-2026-53916] Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp
High7.5
Jun 30, 2026
High [CVE-2026-49270 +1] Apache ActiveMQ: Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.
High7.5
Jun 30, 2026
High [CVE-2026-50734] Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All
High7.5
Jun 30, 2026
High [CVE-2026-49877] Apache ActiveMQ: Improper Authorization vulnerability in Apache ActiveMQ.
High8.1
Jun 30, 2026
High [CVE-2026-49434] Apache ActiveMQ: Improper Input Validation vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All.
High7.5
Jun 30, 2026
High [CVE-2026-49432] Apache ActiveMQ: Improper Input Validation vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp.
High7.5
Jun 30, 2026
Medium [CVE-2025-53648] SQL misconfiguration in the Gravitino UI, in versions 1.0.0 and below, can allow a malicious user to read or truncate files
Medium5.4
Jun 30, 2026
Medium [CVE-2026-52760] Apache ActiveMQ Web: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache ActiveMQ, Apache…
Medium6.1
Jun 26, 2026
Advisory [CVE-2026-57915] Apache Kerby: Kerberos Pre-Authentication Bypass
Unrated
Jun 26, 2026
Advisory [CVE-2026-49486] Apache Airflow FTP provider: FTP Provider does not protect FTPS data channel (missing PROT_P)
Unrated
Jun 17, 2026
Advisory [CVE-2026-32967] Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks
Unrated
Jun 12, 2026
Advisory [CVE-2026-50645] Apache CXF: No restriction on attachment headers per message
Unrated
Jun 12, 2026
Advisory [CVE-2026-50634] Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry
Unrated
Jun 12, 2026
Advisory [CVE-2026-50633] Apache CXF: JNDI Injection vulnerability in DispatchMDBMessageListenerImpl
Unrated
Jun 12, 2026
Advisory [CVE-2026-44417 +1] Apache CXF: JNDI Injection Vulnerability in JMSConfigFactory
Unrated
Jun 12, 2026
Advisory [CVE-2026-50631] Apache CXF: OAuth2: TOCTOU Race Condition in Refresh Token Processing
Unrated
Jun 12, 2026
Advisory [CVE-2026-50630] Apache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm Injection
Unrated
Jun 12, 2026
Advisory [CVE-2026-50629] Apache CXF: OAuth2: Log Injection via Unsanitized Client Identifier
Unrated
Jun 12, 2026
Advisory [CVE-2026-50628] Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control
Unrated
Jun 12, 2026
Advisory [CVE-2026-50627] Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator
Unrated
Jun 12, 2026
Advisory [CVE-2026-49875] Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils
Unrated
Jun 12, 2026
Advisory [CVE-2026-50623] Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService
Unrated
Jun 8, 2026
Advisory [CVE-2026-49975] Apache HTTP Server: mod_http2 denial of service
Unrated
Jun 8, 2026
Advisory [CVE-2026-42536] Apache HTTP Server: mod_xml2enc heap overflow
Unrated
Jun 8, 2026
Advisory [CVE-2026-44185] Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request`
Unrated
Jun 8, 2026
Advisory [CVE-2026-34355] Apache HTTP Server: mod_proxy_html buffer overflow
Unrated
Jun 1, 2026
Advisory [CVE-2026-40861] Apache Airflow: Arbitrary File Read via Log Symlink following in FileTaskHandler
Unrated
Jun 1, 2026
Advisory [CVE-2026-40961] Apache Airflow: Open Redirect Bypass Vulnerability
Unrated
Jun 1, 2026
Advisory [CVE-2026-40963] Apache Airflow: DAG authorization bypass on /ui/structure/structure_data
Unrated
Jun 1, 2026
Advisory [CVE-2026-41014] Apache Airflow: per-DAG RBAC bypass on /ui/partitioned_dag_runs endpoints
Unrated
Jun 1, 2026
Advisory [CVE-2026-49267] Apache Airflow: No certificate validation on SMTP STARTTLS connections
Unrated
Jun 1, 2026
Advisory [CVE-2026-41017] Apache Airflow: JWT cookie missing Secure flag in JWTRefreshMiddleware behind HTTPS-terminating proxy
Unrated
Jun 1, 2026
Advisory [CVE-2026-41084] Apache Airflow: API authorization bypass: bulk TaskInstances allows cross-DAG mutation
Unrated
Jun 1, 2026
Advisory [CVE-2026-42252] Apache Airflow: BashOperator Jinja2 injection via dag_run.conf — low-privilege user pattern
Unrated
Jun 1, 2026
Advisory [CVE-2026-42360] Apache Airflow: Rendered template truncation bypasses nested sensitive-key masking
Unrated
Jun 1, 2026
Advisory [CVE-2026-42358] Apache Airflow: Variable masker depth-limit bypass returns cleartext nested secrets
Unrated
Jun 1, 2026
Advisory [CVE-2026-42359] Apache Airflow: Authenticated RCE via XCom PATCH endpoint — XComUpdateBody missing FORBIDDEN_XCOM_KEYS validator
Unrated
Jun 1, 2026
Advisory [CVE-2026-45360] Apache Airflow: Arbitrary import in custom deadline-reference deserialization
Unrated
Jun 1, 2026
Advisory [CVE-2026-45426] Apache Airflow: Log server JWT authorization bypass via Python lstrip character stripping allows cross-Dag log access
Unrated
Jun 1, 2026
Advisory [CVE-2026-46764] Apache Airflow: Event Log detail endpoint bypasses DAG-scoped event log permission filter
Unrated
Jun 1, 2026
Advisory [CVE-2026-48726] Apache Airflow: revoke_token unreachable in FabAuthManager / KeycloakAuthManager logout path
Unrated
Jun 1, 2026
Advisory [CVE-2026-49298] Apache Airflow: JWT Token Exposure in KubernetesExecutor Command-Line Arguments
Unrated
Jun 1, 2026
Advisory [CVE-2026-45192] Apache Airflow: Incomplete Redaction of Sensitive Fields in Connection Extra API Response
Unrated

Get an email when Apache publishes the next one.

See Apache's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about Apache

Dates are each advisory's publication date at the source, in UTC; a record with no source date is filed under the day VulniPulse first saw it.