Apache security advisories, October 2026

Every Apache Software Foundation security advisory published in October 2026, from ASF Security ([email protected] CNA) via NVD, with its severity, CVEs and CISA KEV status. Open a record for affected and fixed versions and the vendor's own link.

Advisories: 348
Critical: 34
High: 125
In CISA KEV: 0

Apache advisories published in October 2026

Oct 31, 2026
Critical [CVE-2026-118636] Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder
Critical9.8
Oct 31, 2026
High [CVE-2026-120135] Apache Thrift: Java TProtocolUtil.skip does not limit the recursion depth by default
High8.2
Oct 30, 2026
Critical [CVE-2026-64618] Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache Fineract (through version 1.15.0)
Critical9.8
Oct 30, 2026
High [CVE-2026-65874] Apache Fineract: SQL injection via ORDER BY parameters in the Center and datatables endpoints
High8.8
Oct 30, 2026
Advisory [CVE-2026-73322] Incorrect Authorization vulnerability in the single-stage query engine of Apache Pinot
Unrated
Oct 29, 2026
Medium [CVE-2026-71569] Server-Side Request Forgery (SSRF) vulnerability in Apache Camel A2A component
Medium4.8
Oct 29, 2026
Advisory [CVE-2026-115942] Apache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow read
Unrated
Oct 29, 2026
Advisory [CVE-2026-114230] Apache Qpid Proton C: Potential authentication bypass: regular AMQP frames can be sent as SASL frames
Unrated
Oct 29, 2026
Advisory [CVE-2026-105042] Apache Qpid Proton C: Unbounded recursion in parsing AMQP message bodies can lead to crash
Unrated
Oct 29, 2026
Advisory [CVE-2026-105031] Apache Qpid Proton C: The OpenSSL TLS implementation adds a locally trusted certificate authority to the existing trusted system trust anchors.
Unrated
Oct 28, 2026
Advisory [CVE-2026-114349] Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches
Unrated
Oct 28, 2026
Advisory [CVE-2026-112375] Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigs
Unrated
Oct 28, 2026
Advisory [CVE-2026-116593] Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpoint
Unrated
Oct 28, 2026
Advisory [CVE-2026-115644] Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions
Unrated
Oct 28, 2026
Advisory [CVE-2026-111551] Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocation
Unrated
Oct 28, 2026
Advisory [CVE-2026-111496] Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation
Unrated
Oct 28, 2026
Advisory [CVE-2026-111115] Apache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexible protocol request parsing
Unrated
Oct 28, 2026
Advisory [CVE-2026-111108] Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readers
Unrated
Oct 28, 2026
Advisory [CVE-2026-111073] Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of service
Unrated
Oct 28, 2026
Advisory [CVE-2026-110985] Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured
Unrated
Oct 28, 2026
Advisory [CVE-2026-110952] Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by default
Unrated
Oct 28, 2026
Advisory [CVE-2026-83525] Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated network clients to crash the KRaft controller via a malformed request.
Unrated
Oct 26, 2026
High [CVE-2026-111422] In apache-airflow-providers-ssh before 7.0.1, SSHRemoteJobOperator quoted the values of its templated `environment` parameter only once, although they are placed inside an already-quoted wrapper script, so shell syntax such as `$(...)` in a value was executed on the remote SSH host
High8.8
Oct 26, 2026
High [CVE-2026-115748] **UNSUPPORTED WHEN ASSIGNED** Authorization bypass in Apache Vysper, all versions
High8.8
Oct 26, 2026
High [CVE-2026-115721] **UNSUPPORTED WHEN ASSIGNED** Unbounded allocation in XML parsing in Apache Vysper; all versions, may lead to an out of memory condition
High7.5
Oct 26, 2026
High [CVE-2026-90885] Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component
High7.5
Oct 26, 2026
Medium [CVE-2026-94386] Use of Cache Containing Sensitive Information vulnerability in Apache Camel Oauth component
Medium4.8
Oct 26, 2026
Medium [CVE-2026-110748] This issue affects Apache SIS from version 0.7 through 1.6 inclusive
Medium5.5
Oct 26, 2026
Medium [CVE-2026-110733] Vulnerability in the SQL storage module of Apache SIS
Medium5.4
Oct 26, 2026
Medium [CVE-2026-95628] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Docling component
Medium5.4
Oct 26, 2026
Medium [CVE-2026-95629] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Docling component
Medium5.4
Oct 26, 2026
Medium [CVE-2026-95663] Insufficient Session Expiration vulnerability in Apache Camel Keycloak component
Medium4.8
Oct 26, 2026
Medium [CVE-2026-95664] Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel AWS2-s3 component
Medium5.4
Oct 26, 2026
Medium [CVE-2026-101259] Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CoAP component
Medium5.3
Oct 22, 2026
High [CVE-2026-113582] UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests when an application parses attacker-controlled XML with Abdera
High8.7
Oct 22, 2026
Medium [CVE-2026-103634] Out-of-bounds read and write in the Count-Min sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp)
Medium5.3
Oct 21, 2026
Critical [CVE-2026-111811] Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache
Critical9.4
Oct 21, 2026
Critical [CVE-2026-111816] Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out bypassed the rejection path
Critical9.2
Oct 21, 2026
Critical [CVE-2025-31699] Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, including when the client used Expect: 100-continue
Critical9.1
Oct 21, 2026
Critical [CVE-2026-111813] Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) configuration
Critical10.0
Oct 21, 2026
Critical [CVE-2026-105944] Apache Pulsar Manager is a web console for administering Apache Pulsar clusters
Critical10.0
Oct 21, 2026
Critical [CVE-2026-105869] Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user role
Critical9.2
Oct 21, 2026
High [CVE-2026-112381] Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origin response is being reparsed from a reentrant write-ready callback, a timing-dependent race introduced by the CVE-2021-32564 flow-control backports
High8.2
Oct 21, 2026
High [CVE-2026-111812] Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials
High7.0
Oct 21, 2026
High [CVE-2026-111810] Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a request carrying many such headers makes the proxy write far more log data than the request contains
High8.7
Oct 21, 2026
High [CVE-2026-111815] Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verify_client STRICT policy
High7.8
Oct 21, 2026
High [CVE-2026-111814] Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a different one
High7.8
Oct 21, 2026
High [CVE-2026-111808] Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame
High7.7
Oct 21, 2026
High [CVE-2026-111805] Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value
High7.7
Oct 21, 2026
High [CVE-2025-55702] When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the client connection as the next request
High7.0
Oct 21, 2026
High [CVE-2026-111804] Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API
High8.8
Oct 21, 2026
High [CVE-2026-105945] Apache Pulsar: The Pulsar Packages Management Service can be configured to store packages on the local filesystem of the broker by using the filesystem storage provider
High7.7
Oct 21, 2026
High [CVE-2026-105942] Apache Pulsar: When a configured proxy role sends a request to the broker on behalf of another user (the original principal), the broker is designed to authorize both the proxy role and the original principal and to allow the request only if both are authorized, so that the original principal cannot exceed its own permissions
High7.7
Oct 21, 2026
High [CVE-2026-105937] Apache Pulsar shadow topics (PIP-180) are topics that read the stored messages of a source topic from that topic's managed ledger
High8.7
Oct 21, 2026
High [CVE-2026-105934] The Apache Pulsar broker admin REST API provides a truncate operation for persistent topics (DELETE /admin/v2/persistent/{tenant}/{namespace}/{topic}/truncate)
High7.2
Oct 21, 2026
High [CVE-2026-82230] Uncontrolled recursion in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server crash via sending deeply nested mcpack data
High7.5
Oct 21, 2026
High [CVE-2026-56386] Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload
High7.5
Oct 21, 2026
High [CVE-2026-74757] Uncontrolled resource allocation in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server allocate a large amount of memory via sending a crafted mcpack request with a huge array item count
High7.5
Oct 21, 2026
Medium [CVE-2026-111817] Apache Traffic Server can stall a chunked transfer that it passes through with its trailers removed (proxy.config.http.drop_chunked_trailers) until the connection times out, because it waits for the trailer bytes it has already dropped
Medium6.9
Oct 21, 2026
Medium [CVE-2026-111809] Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding
Medium6.9
Oct 21, 2026
Medium [CVE-2026-105936] Apache Pulsar: The Pulsar Functions worker REST API provides two endpoints that return the catalog of Pulsar IO connectors installed on the functions worker: the worker connectors endpoint (/admin/v2/worker/connectors) and the deprecated functions connectors endpoint (/admin/v2/functions/connectors and /admin/v3/functions/connectors)
Medium5.3
Oct 21, 2026
Medium [CVE-2026-105935] Apache Pulsar: The Pulsar Functions Worker provides a REST API endpoint for triggering a function, which publishes a caller-supplied value to one of the function's configured input topics
Medium4.9
Oct 21, 2026
Medium [CVE-2026-105930] Apache Pulsar: When package management is enabled, Pulsar Functions, Sources and Sinks can be registered or updated from a package stored in the Pulsar Packages Management Service by supplying a package URL
Medium6.0
Oct 21, 2026
Medium [CVE-2026-105926] Apache Pulsar: Missing Topic Authorization on Binary Protocol GetSchema and GetOrCreateSchema Commands
Medium5.3
Oct 21, 2026
Medium [CVE-2026-90484] The MySQL client response parser in Apache bRPC dereferences a null pointer when the server peer sends a zero-payload-length response packet
Medium6.5
Oct 21, 2026
Medium [CVE-2026-87849] The Discovery naming-service reply parser in Apache bRPC (versions < 1.18.0) calls RapidJSON object-only accessors (FindMember) on JSON values without first validating that those values are objects
Medium4.3
Oct 21, 2026
Medium [CVE-2026-84727] Use-after-free in the RTMP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows a malicious RTMP peer to crash the process or potentially corrupt memory via a crafted Abort message
Medium5.4
Oct 21, 2026
Medium [CVE-2026-82953] NULL pointer dereference in the RTMP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to crash the server (denial of service) via a crafted createStream command
Medium5.3
Oct 21, 2026
Low [CVE-2026-105938] Apache Pulsar namespaces can restrict which roles may use a subscription, either with the Prefix subscription authentication mode, which requires a subscription name to start with the role name, or by granting permission on a subscription to specific roles
Low2.3
Oct 21, 2026
Low [CVE-2026-105933] Apache Pulsar allows an administrator to require end-to-end message encryption for all topics in a namespace by setting the encryption_required namespace policy
Low2.3
Oct 21, 2026
Low [CVE-2026-105932] The Apache Pulsar broker admin REST API provides endpoints to read, set and remove the topic-level entry filter policy of a topic
Low2.3
Oct 21, 2026
Low [CVE-2026-105931] The Apache Pulsar broker exposes a transaction administration REST API under /admin/v3/transactions
Low2.3
Oct 21, 2026
Low [CVE-2026-105927] Apache Pulsar: Improper authorization of WebSocket consumer dead letter topic allows writes without PRODUCE permission
Low2.3
Oct 21, 2026
Advisory [CVE-2026-86249] Apache bRPC: Authentication bypass when a server sets ServerOptions.internal_port and ServerOptions.auth
Unrated
Oct 21, 2026
Advisory [CVE-2026-86147] Apache bRPC: Arbitrary file creation/truncation via /flags and unbounded profiling duration via /pprof
Unrated
Oct 21, 2026
Advisory [CVE-2026-86146] Apache bRPC: HTTP Request Smuggling and Header Injection via Lenient HTTP/1.1 Header Parsing
Unrated
Oct 21, 2026
Advisory [CVE-2026-84748] Apache bRPC: Builtin services reachable from the public port via protobuf protocols despite ServerOptions.internal_port configuration
Unrated
Oct 21, 2026
Advisory [CVE-2026-84747] Apache bRPC: Access Control Bypass via HTTP Request Paths Containing Empty Path Segments
Unrated
Oct 21, 2026
Advisory [CVE-2026-82942] Apache bRPC: Race Condition on the Shared Socket Input Buffer in the RDMA Transport Causes Remote Denial of Service
Unrated
Oct 21, 2026
Advisory [CVE-2026-82425] Apache bRPC: Reachable Assertion in Socket::OnInputEvent Allows Remote Denial of Service
Unrated
Oct 21, 2026
Advisory [CVE-2026-82231] Apache bRPC: Malformed Thrift T_EXCEPTION reply causes process termination in Thrift client
Unrated
Oct 21, 2026
Advisory [CVE-2026-82210] Apache bRPC: Remote denial of service (crash) via malformed stream feedback frames
Unrated
Oct 21, 2026
Advisory [CVE-2026-81755] Apache bRPC: Uncontrolled Resource Consumption via Excessive Streams in a Single RPC Request
Unrated
Oct 21, 2026
Advisory [CVE-2026-80463] Apache bRPC: Unbounded Memory Accumulation in Stream Message Reassembly
Unrated
Oct 21, 2026
Advisory [CVE-2026-79704] Apache bRPC: Out-of-bounds Read in Multi-stream RPC Response Handling
Unrated
Oct 21, 2026
Advisory [CVE-2026-78334] Apache bRPC: Missing Authentication for Streaming RPC Frames
Unrated
Oct 21, 2026
Advisory [CVE-2026-74755] Apache bRPC: Integer Underflow in mcpack2pb Parser Leading to Denial of Service
Unrated
Oct 21, 2026
Advisory [CVE-2026-66392] Apache bRPC: TLS Client Accepts Certificates for Mismatched Peer Names
Unrated
Oct 21, 2026
Advisory [CVE-2026-61916] Apache bRPC: Out-of-bounds Read in URL and Header Lookup Tables on Unsigned-char Platforms
Unrated
Oct 21, 2026
Advisory [CVE-2026-61902] Apache bRPC: Memory Exhaustion Through Inconsistent Message Body Limits
Unrated
Oct 21, 2026
Advisory [CVE-2026-58064] Apache bRPC: Denial of Service via Unbounded Redis Inline Command Allocation
Unrated
Oct 21, 2026
Advisory [CVE-2026-56388] Apache bRPC: Out-of-Bounds Write in Redis Command Parser
Unrated
Oct 21, 2026
Advisory [CVE-2026-56387] Apache bRPC: Remote Memory Exhaustion in RTMP AMF Parser
Unrated
Oct 21, 2026
Advisory [CVE-2026-54427] Apache bRPC: Stack Exhaustion via Unbounded Recursion in AMF Parser
Unrated
Oct 21, 2026
Advisory [CVE-2026-54426] Apache bRPC: Stack Exhaustion via Unbounded Recursion in Redis Reply Parser
Unrated
Oct 21, 2026
Advisory [CVE-2026-54425] Apache bRPC: Stack Exhaustion via Recursive HPACK Dynamic Table Size Update Decoding
Unrated
Oct 21, 2026
Advisory [CVE-2026-48830] Apache bRPC: HTTP builtin request can mark a connection authenticated and bypass auth for later requests
Unrated
Oct 21, 2026
Advisory [CVE-2026-59229] Apache IoTDB: Legacy Pipe Privilege Escalation
Unrated
Oct 21, 2026
Advisory [CVE-2026-59562] Missing authentication for critical function vulnerability in Apache IoTDB
Unrated
Oct 21, 2026
Advisory [CVE-2026-41114] Uncontrolled Resource Consumption vulnerability in Apache IoTDB JDBC driver
Unrated

Page 1 of 4 · 100 of 348

Get an email when Apache publishes the next one.

See Apache's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about Apache

Dates are each advisory's publication date at the source, in UTC; a record with no source date is filed under the day VulniPulse first saw it.