Apache security advisories, August 2026

Apache advisories published in August 2026

1. Aug 10, 2026
   High [CVE-2026-55814] Missing Authentication in Apache Ranger Download APIs on versions <= 2.8.0

   High7.5

2. Aug 10, 2026
   High [CVE-2026-65942] TLS hostname verification issue in Apache Ranger Client Code in versions <= 2.8.0

   High7.5

3. Aug 10, 2026
   High [CVE-2026-65948] UnixAuth lacks brute-force protection in Apache Ranger versions <= 2.8.0

   High7.3

4. Aug 10, 2026
   High [CVE-2026-44630] Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to cause a denial of service

   High7.5

5. Aug 10, 2026
   Medium [CVE-2026-68872] Apache Airflow Amazon provider: amazon SSM / Secrets Manager backends: team-scope guard bypass resolves another team's Connection or Variable

   Medium6.5

6. Aug 10, 2026
   Medium [CVE-2026-68871] Apache Airflow Yandex provider: yandex Lockbox backend: team-scope guard bypass resolves another team's Connection or Variable

   Medium6.5

7. Aug 10, 2026
   Medium [CVE-2026-68870] Apache Airflow Microsoft Azure provider: microsoft.azure Key Vault backend: team-scope guard bypass resolves another team's Connection or Variable

   Medium5.3

8. Aug 10, 2026
   Medium [CVE-2026-65945] Logs contain replayable JWT tokens in Apache Ranger versions <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue

   Medium6.5

9. Aug 7, 2026
   Critical [CVE-2026-71558] Heap type confusion vulnerability in Apache Fory C++ deserialization

   Critical9.8

10. Aug 7, 2026
    Critical [CVE-2026-71560] Out-of-bounds Read vulnerability in Apache Fory C++ deserialization

    Critical9.1

11. Aug 7, 2026
    High [CVE-2026-71559] Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a denial of service by supplying crafted data containing malformed type metadata, which triggers an uncaught panic

    High7.5

12. Aug 6, 2026
    Critical [CVE-2026-32327] bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem function

    Critical9.1

13. Aug 6, 2026
    Critical [CVE-2026-34191] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider

    Critical9.1

14. Aug 6, 2026
    Critical [CVE-2026-61466] In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the `scope` value supplied in the client registration request verbatim, without validating it against an AS-defined allowlist

    Critical9.1

15. Aug 6, 2026
    Critical [CVE-2026-63687] Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive parameters

    Critical9.1

16. Aug 6, 2026
    Critical [CVE-2026-65583] Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/audience/time and sub_jwk binding), enabling authentication bypass with crafted tokens

    Critical9.1

17. Aug 6, 2026
    Critical [CVE-2026-68079] In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeGrant functionality

    Critical9.8

18. Aug 6, 2026
    Critical [CVE-2026-66909] Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place

    Critical9.8

19. Aug 6, 2026
    High [CVE-2025-49506] APR-util versions 1.6.3 (and earlier) function apr_password_validate was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt such as Windows, BeOS, NetWare, or Android

    High7.5

20. Aug 6, 2026
    High [CVE-2026-34501] Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client

    High7.5

21. Aug 6, 2026
    High [CVE-2026-34502] Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3

    High7.5

22. Aug 6, 2026
    High [CVE-2026-57818] race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens

    High8.1

23. Aug 6, 2026
    High [CVE-2026-68481] In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports active:true

    High7.5

24. Aug 6, 2026
    High [CVE-2026-65432] Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities

    High7.5

25. Aug 6, 2026
    High [CVE-2026-57817] Apache CXF RP: The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the `c_hash` parameter when operating in the Hybrid Flow

    High8.1

26. Aug 6, 2026
    High [CVE-2026-50645 +1] incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a message with many attachment headers

    High7.5

27. Aug 6, 2026
    High [CVE-2026-57819] Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option

    High7.5

28. Aug 6, 2026
    High [CVE-2026-54225] Apache CXF allows to control the maximum attachment size via the "attachment-max-size"

    High7.5

29. Aug 6, 2026
    Medium [CVE-2026-64640] Apache Polaris did not consistently validate storage locations supplied during table and view registration

    Medium5.3

30. Aug 5, 2026
    Critical [CVE-2026-60053] Insufficient Session Expiration vulnerability in Apache Answer

    Critical9.1

31. Aug 5, 2026
    Critical [CVE-2026-61486] Apache Lucy: stack-buffer-overflow in JSON parser error reporter on malformed input

    Critical9.8

32. Aug 5, 2026
    Critical [CVE-2026-61484] Apache Lucy: LucyX::Remote::SearchServer unauthenticated remote Storable::thaw -> RCE/DoS

    Critical9.8

33. Aug 5, 2026
    High [CVE-2026-60023] Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer

    High7.5

34. Aug 5, 2026
    High [CVE-2026-48911] Insufficient Verification of Data Authenticity vulnerability in Apache Answer

    High7.5

35. Aug 5, 2026
    High [CVE-2026-48834] Improper Handling of Length Parameter Inconsistency vulnerability in Apache Answer

    High7.5

36. Aug 5, 2026
    High [CVE-2026-61485] ** UNSUPPORTED WHEN ASSIGNED ** Memory Allocation with Excessive Size Value vulnerability in Apache Lucy

    High7.5

37. Aug 5, 2026
    High [CVE-2026-61483] Apache Lucy: QueryParser unbounded recursion on deeply-nested query -> C-stack-overflow DoS

    High7.5

38. Aug 5, 2026
    High [CVE-2026-67592] Apache Qpid ProtonJ2: It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service

    High7.5

39. Aug 5, 2026
    High [CVE-2026-67590] Apache Qpid ProtonJ2: pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service

    High7.5

40. Aug 5, 2026
    High [CVE-2026-67552] Apache Qpid Proton-Dotnet: pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service

    High7.5

41. Aug 5, 2026
    High [CVE-2026-68073] Apache Qpid Broker-J: pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service

    High7.5

42. Aug 5, 2026
    High [CVE-2026-66274] Apache Qpid Proton-J: pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service

    High7.5

43. Aug 5, 2026
    High [CVE-2026-67589] Apache Qpid ProtonJ2: pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service

    High7.5

44. Aug 5, 2026
    High [CVE-2026-67551] Apache Qpid Proton-Dotnet: pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service

    High7.5

45. Aug 5, 2026
    High [CVE-2026-68060] Apache Qpid Broker-J: pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service

    High7.5

46. Aug 5, 2026
    High [CVE-2026-66273] Apache Qpid Proton-J: pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service

    High7.5

47. Aug 5, 2026
    High [CVE-2026-67588] Apache Qpid ProtonJ2: pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service

    High7.5

48. Aug 5, 2026
    High [CVE-2026-67465] Apache Qpid Proton-Dotnet: pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service

    High7.5

49. Aug 5, 2026
    High [CVE-2026-68074] Apache Qpid Broker-J: pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service

    High7.5

50. Aug 5, 2026
    High [CVE-2026-66257] Apache Qpid Proton-J: pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service

    High7.5

51. Aug 5, 2026
    Medium [CVE-2026-50749] Improper Authorization vulnerability in Apache Answer

    Medium6.5

52. Aug 5, 2026
    Medium [CVE-2026-48912] Improper Input Validation vulnerability in Apache Answer

    Medium6.5

53. Aug 5, 2026
    Medium [CVE-2026-68080] Apache Qpid Broker-J: It was not possible to govern the rate at which the broker would respond to an echo flow, enabling an authenticated attacker to cause excessive resource usage and potential denial of service

    Medium6.5

54. Aug 5, 2026
    Medium [CVE-2026-67555] It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service This issue affects Apache Qpid Proton-Dotnet: through 1.0.0

    Medium6.5

55. Aug 5, 2026
    Medium [CVE-2026-68078] Apache Qpid Broker-J: It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service

    Medium6.5

56. Aug 5, 2026
    Medium [CVE-2026-66277] Apache Qpid Proton-J: It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service

    Medium6.5

57. Aug 5, 2026
    Medium [CVE-2026-67554] Apache Qpid Proton-Dotnet: authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to denial of service

    Medium6.5

58. Aug 5, 2026
    Medium [CVE-2026-68077] Apache Qpid Broker-J: authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to denial of service

    Medium6.5

59. Aug 5, 2026
    Medium [CVE-2026-66276] Apache Qpid Proton-J: authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to denial of service

    Medium6.5

60. Aug 5, 2026
    Medium [CVE-2026-67591] Apache Qpid ProtonJ2: authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service

    Medium6.5

61. Aug 5, 2026
    Medium [CVE-2026-67553] Apache Qpid Proton-Dotnet: authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service

    Medium6.5

62. Aug 5, 2026
    Medium [CVE-2026-68075] Apache Qpid Broker-J: authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service

    Medium6.5

63. Aug 5, 2026
    Medium [CVE-2026-66275] Apache Qpid Proton-J: authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service

    Medium6.5

64. Aug 3, 2026
    High [CVE-2026-68981] Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter

    High8.8

65. Aug 3, 2026
    High [CVE-2026-62354] Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows clients with read access to submit proposed Parameter values

    High7.7

66. Aug 3, 2026
    High [CVE-2026-61372] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Jena Fuseki

    High7.5

67. Aug 3, 2026
    Medium [CVE-2026-68979] Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values

    Medium5.9

68. Aug 3, 2026
    Low [CVE-2026-68980] Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API

    Low2.3

Page 2 of 2 · 68 of 168