Apache security advisories, July 2026

Every Apache Software Foundation security advisory published in July 2026, from ASF Security ([email protected] CNA) via NVD, with its severity, CVEs and CISA KEV status. Open a record for affected and fixed versions and the vendor's own link.

Advisories: 180
Critical: 41
High: 82
In CISA KEV: 0

Apache advisories published in July 2026

Jul 31, 2026
High [CVE-2025-66518 +1] Apache Kyuubi Server: The security fix for CVE-2025-66518 is incomplete
High8.1
Jul 31, 2026
Medium [CVE-2026-44615] Path traversal vulnerability in Apache Zeppelin
Medium6.5
Jul 31, 2026
Medium [CVE-2026-64607] Apache HttpComponents Client: Connection Leak on Content-Encoding Decode Error Leads to Pool Exhaustion DoS
Medium5.3
Jul 30, 2026
Critical [CVE-2026-52680] Apache Kyuubi REST batch multipart upload handling uses the client-supplied multipart filename when creating a temporary uploaded resource
Critical9.8
Jul 30, 2026
Critical [CVE-2026-28812] UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to escalate privileges
Critical9.8
Jul 30, 2026
High [CVE-2026-28814] Arbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki up to 2.12.3 allows attacker to obtain sensitive data stored in JSPWiki variables
High7.5
Jul 30, 2026
High [CVE-2026-28813] Apache JSPWiki, up to 2.12.3, is vulnerable to JSON Hijacking, which leads to csrf vulnerabilities
High8.8
Jul 30, 2026
High [CVE-2026-28811] Debug Messages Revealing Unnecessary Information in Apache JSPWiki up to 2.12.3
High7.5
Jul 30, 2026
Medium [CVE-2026-66756] Improper Protection of Alternate Path vulnerability in Apache Tika
Medium6.9
Jul 30, 2026
Medium [CVE-2026-66755] Apache Tika: Arbitrary Local File Read in ISArchiveParser
Medium5.9
Jul 30, 2026
Medium [CVE-2026-23985] Regular Expression Denial of Service (ReDoS) vulnerability exists in Apache Superset versions 1.5.0 through 5.0.0
Medium5.3
Jul 30, 2026
Medium [CVE-2026-23981] Improper Authorization vulnerability exists in Apache Superset allowing an authenticated user with permissions to update charts to modify dashboards they do not own
Medium5.3
Jul 30, 2026
Medium [CVE-2026-48910] carefully crafted editing request could trigger an XSS vulnerability on Apache JSPWiki when parsing errors on the markdown renderer, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim
Medium6.5
Jul 30, 2026
Medium [CVE-2024-31867 +1] LDAP filter injection vulnerability in Apache Zeppelin
Medium6.5
Jul 30, 2026
Medium [CVE-2026-44616] LDAP injection vulnerability in Apache Zeppelin
Medium6.5
Jul 30, 2026
Medium [CVE-2026-44613] Apache Zeppelin: Cross-site request forgery in REST and WebSocket request handling
Medium6.1
Jul 29, 2026
Critical [CVE-2026-58162] Apache Traffic Server: Certifier plugin trusts client SNI when generating certificates
Critical10.0
Jul 29, 2026
Critical [CVE-2026-59243] Apache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (`verify_signature` defaults to `False`)
Critical9.8
Jul 29, 2026
Critical [CVE-2026-58155] Apache Traffic Server: Header-name length truncation enables header aliasing and request smuggling
Critical9.3
Jul 29, 2026
Critical [CVE-2026-58150] Apache Traffic Server: HTTP/2 requests with Transfer-Encoding are not rejected, allowing request smuggling
Critical10.0
Jul 29, 2026
Critical [CVE-2026-57834] Apache Traffic Server: Malformed chunked message body allows request smuggling
Critical10.0
Jul 29, 2026
High [CVE-2026-50622] Missing Authorization in Apache Atlas
High8.8
Jul 29, 2026
High [CVE-2026-23904] Apache Kyuubi: Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination
High7.3
Jul 29, 2026
High [CVE-2026-58189] Apache Traffic Server: Plugins resetting the redirect counter enable SSRF amplification
High7.5
Jul 29, 2026
High [CVE-2026-58188] Apache Traffic Server: Memory-safety and limit-bypass errors across experimental plugins
High8.2
Jul 29, 2026
High [CVE-2026-58186] Apache Traffic Server: webp_transform plugin decodes unsafely and mislabels degraded responses
High7.5
Jul 29, 2026
High [CVE-2026-58184] Apache Traffic Server: header_rewrite plugin cookie handling can corrupt memory
High8.2
Jul 29, 2026
High [CVE-2026-58182] Apache Traffic Server: ts_lua plugin has initialization and resource-handling errors
High8.6
Jul 29, 2026
High [CVE-2026-58181] Apache Traffic Server: uri_signing and url_sig plugins can exhaust the stack or crash
High7.5
Jul 29, 2026
High [CVE-2026-58180] Apache Traffic Server: txn_box plugin overflows the stack from attacker input
High7.5
Jul 29, 2026
High [CVE-2026-58179] Apache Traffic Server: regex_remap plugin overflows the stack from attacker input
High8.1
Jul 29, 2026
High [CVE-2026-58178] Apache Traffic Server: ESI plugin allows uncontrolled recursion and server-side request forgery
High7.5
Jul 29, 2026
High [CVE-2026-58177] The Apache Traffic Server Cripts framework has out-of-bounds writes, path traversal, and use-after-free errors
High8.3
Jul 29, 2026
High [CVE-2026-58175] Apache Traffic Server: HostDB SRV handling leaks memory
High7.5
Jul 29, 2026
High [CVE-2026-58164] Apache Traffic Server: Remap configuration lifetime and TOCTOU errors cause use-after-free
High7.5
Jul 29, 2026
High [CVE-2026-58163] Apache Traffic Server: Cache deserialization and lifetime errors can corrupt state or crash the server
High7.5
Jul 29, 2026
High [CVE-2026-58161] Apache Traffic Server: Memory-safety errors in TLS and SNI handling can crash the server
High7.5
Jul 29, 2026
High [CVE-2026-58159] Apache Traffic Server: Listener and ACL handling allow access-control bypass
High8.2
Jul 29, 2026
High [CVE-2026-58157] Apache Traffic Server: Improper server-session reuse can expose data across client connections
High8.7
Jul 29, 2026
High [CVE-2026-58154] Apache Traffic Server: Memory-safety errors in MIME and header parsing
High8.9
Jul 29, 2026
High [CVE-2026-65324] Apache Traffic Server: HTTP/2 and HTTP/3 dechunking removes per-stream buffer cap, allowing memory exhaustion
High7.5
Jul 29, 2026
High [CVE-2026-58151] Apache Traffic Server: Abusive HTTP/2 framing can exhaust resources and crash the server
High7.5
Jul 29, 2026
High [CVE-2026-33267] Improper Input Validation vulnerability in Apache Traffic Server
High7.7
Jul 29, 2026
High [CVE-2026-41920] Improper Access Control vulnerability in Apache Traffic Server
High7.0
Jul 29, 2026
Medium [CVE-2026-65100] Apache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encode
Medium4.8
Jul 29, 2026
Medium [CVE-2026-58185] Apache Traffic Server: Use-after-free in the intercept plugin
Medium5.9
Jul 29, 2026
Medium [CVE-2026-58183] Apache Traffic Server: prefetch plugin can crash on attacker-influenced input
Medium5.9
Jul 29, 2026
Medium [CVE-2026-58160] Apache Traffic Server: Out-of-bounds reads while parsing DNS responses
Medium6.5
Jul 29, 2026
Medium [CVE-2026-58158] Apache Traffic Server: PROXY protocol parsing has port truncation and a stack overflow
Medium5.9
Jul 29, 2026
Medium [CVE-2026-58156] Apache Traffic Server: URL and port parsing errors allow access-control bypass
Medium4.9
Jul 29, 2026
Medium [CVE-2026-65325] Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying the server certificate covers the new request hostname
Medium6.3
Jul 29, 2026
Medium [CVE-2026-58153] Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when converting HTTP/2 to HTTP/1
Medium6.3
Jul 29, 2026
Medium [CVE-2026-58152] Apache Traffic Server: Integer-handling errors in HPACK/XPACK decoding corrupt memory
Medium5.9
Jul 29, 2026
Medium [CVE-2026-33930] Apache Traffic Server: Buffer overflow via Host field that has a long string value
Medium5.9
Jul 29, 2026
Medium [CVE-2026-24033] Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Traffic Server
Medium6.9
Jul 29, 2026
Medium [CVE-2026-22068] Regular Expression without Anchors vulnerability in Apache Traffic Server
Medium6.9
Jul 29, 2026
Low [CVE-2026-58187] Apache Traffic Server: Multiplexer plugin chunk decoder enables a denial of service
Low3.7
Jul 28, 2026
Critical [CVE-2026-66713] Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat (only when Tribes clustering is enabled, which is off by default) allows an unauthenticated remote attacker with network access to the clustering port to execute arbitrary code via a crafted serialized Java object delivered to the cluster channel and deserialized in org.apache.axis2.clustering.tribes.Axis2ChannelListener#messageReceived
Critical9.8
Jul 28, 2026
High [CVE-2026-66299] Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example
High7.5
Jul 28, 2026
High [CVE-2026-59878] Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All
High7.5
Jul 28, 2026
Medium [CVE-2026-61487] Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ
Medium6.5
Jul 27, 2026
Critical [CVE-2026-55971] Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings
Critical9.3
Jul 27, 2026
Critical [CVE-2026-48144] Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift c_glib bindings
Critical9.1
Jul 27, 2026
High [CVE-2026-58662] Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrift C++ bindings
High8.7
Jul 27, 2026
High [CVE-2026-58389] Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Rust bindings
High8.7
Jul 27, 2026
High [CVE-2026-55969] Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi and Haxe bindings
High8.7
Jul 27, 2026
High [CVE-2026-55968] Apache Thrift Node: Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache…
High8.7
Jul 27, 2026
High [CVE-2026-49158] Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Ruby bindings
High7.5
Jul 27, 2026
High [CVE-2026-48586] Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go…
High8.7
Jul 27, 2026
High [CVE-2026-48145] Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift C++ bindings
High8.2
Jul 27, 2026
High [CVE-2026-43871] Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java…
High8.7
Jul 27, 2026
High [CVE-2026-41608] Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Python bindings
High7.5
Jul 27, 2026
Medium [CVE-2026-66391] Use of Insufficiently Random Values, Protection Mechanism Failure vulnerability in Apache Wicket
Medium6.5
Jul 27, 2026
Medium [CVE-2026-66390] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket
Medium6.1
Jul 27, 2026
Medium [CVE-2026-41603 +1] Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift Python bindings
Medium5.9
Jul 27, 2026
Medium [CVE-2026-58023] Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings
Medium6.9
Jul 27, 2026
Medium [CVE-2026-55970] Buffer Over-read vulnerability in Apache Thrift C++ bindings
Medium6.9
Jul 27, 2026
Medium [CVE-2026-45112] Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings
Medium6.9
Jul 24, 2026
High [CVE-2026-45816] NULL Pointer Dereference vulnerability in Apache NimBLE in LE Long Term Key Request event
High7.5
Jul 24, 2026
High [CVE-2026-45815] Reachable Assertion vulnerability in Apache NimBLE
High7.5
Jul 24, 2026
High [CVE-2026-45813] Out-of-bounds Write, Integer Underflow (Wrap or Wraparound) vulnerability in Apache NimBLE BASS service
High8.8
Jul 24, 2026
High [CVE-2026-45811] Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Apache NimBLE
High7.5
Jul 24, 2026
High [CVE-2026-66144] Although remote policy references are not retrieved during policy normalization, if they are manually retrieved
High7.5
Jul 24, 2026
High [CVE-2026-66143] It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.2
High7.5
Jul 24, 2026
High [CVE-2026-66142] Apache Neethi is vulnerable to uncontrolled recursion
High7.5
Jul 24, 2026
Medium [CVE-2026-49326] Missing Authorization vulnerability in Apache HBase thrift and rest delegation service
Medium6.5
Jul 24, 2026
Medium [CVE-2026-46452] Improper Input Validation vulnerability in Apache NimBLE in Mesh Proxy SAR reassembly could
Medium5.3
Jul 24, 2026
Medium [CVE-2026-45812] Incorrect Calculation of Buffer Size vulnerability in Apache NimBLE when processing Legacy Advertising Report HCI event
Medium6.5
Jul 24, 2026
Medium [CVE-2026-63317] Apache OpenNLP: Arbitrary Class Instantiation
Medium5.6
Jul 21, 2026
Critical [CVE-2026-64606] Apache Fory: Deserialization of untrusted data vulnerability that may
Critical9.8
Jul 21, 2026
Critical [CVE-2026-64609] Out-of-bounds read via sun.misc.Unsafe in Apache Fory
Critical9.1
Jul 21, 2026
Critical [CVE-2026-64608] Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation
Critical9.8
Jul 21, 2026
High [CVE-2026-60080] Use After Free vulnerability in the Rust deserialization logic of Apache Fory
High7.3
Jul 20, 2026
Critical [CVE-2026-62183] Improper Privilege Management vulnerability in Apache Syncope
Critical9.8
Jul 20, 2026
Critical [CVE-2026-57308] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope
Critical9.8
Jul 20, 2026
Critical [CVE-2026-53421] Improper Isolation or Compartmentalization vulnerability in Apache Syncope
Critical9.8
Jul 20, 2026
Critical [CVE-2026-53405] Improper Isolation or Compartmentalization vulnerability in Apache Syncope
Critical9.8
Jul 20, 2026
Critical [CVE-2026-63071] Improper Isolation or Compartmentalization vulnerability in Apache Syncope
Critical9.8
Jul 20, 2026
High [CVE-2026-48827 +1] Path traversal on Windows in Apache MINA SSHD component sshd-git
High7.1
Jul 20, 2026
High [CVE-2026-56624] Improper certificate validation in Apache MINA SSHD (server-side)
High7.3

Page 1 of 2 · 100 of 180

Get an email when Apache publishes the next one.

See Apache's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about Apache

Dates are each advisory's publication date at the source, in UTC; a record with no source date is filed under the day VulniPulse first saw it.