Apache security advisories, October 2026

Every Apache Software Foundation security advisory published in October 2026, from ASF Security ([email protected] CNA) via NVD, with its severity, CVEs and CISA KEV status. Open a record for affected and fixed versions and the vendor's own link.

Advisories: 348
Critical: 34
High: 125
In CISA KEV: 0

Apache advisories published in October 2026

Oct 21, 2026
Advisory [CVE-2026-58663] authentication bypass vulnerability exists in Apache IoTDB's Thrift RPC service This issue affects Apache IoTDB: from 2.0.0 before 2.0.11
Unrated
Oct 21, 2026
Advisory [CVE-2026-78066] Apache bRPC: Resource Exhaustion via Unbounded Decompression and Unvalidated Wire-Declared Sizes
Unrated
Oct 21, 2026
Advisory [CVE-2026-78058] Apache bRPC: Unbounded Resource Consumption and Crash in the HTTP/2 Receive Path
Unrated
Oct 21, 2026
Advisory [CVE-2026-78048] Apache bRPC: Remote Denial of Service via Out-of-Bounds Dynamic Table Sizing in HPACK Decoder
Unrated
Oct 21, 2026
Advisory [CVE-2026-74758] Apache bRPC: Heap Use-After-Free in RTMP Abort Message Handling
Unrated
Oct 20, 2026
Critical [CVE-2026-86471] unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB operating system user
Critical9.3
Oct 20, 2026
Critical [CVE-2026-103119] Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly leakage of data from the first response to the second
Critical9.1
Oct 20, 2026
Critical [CVE-2026-101356] Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users
Critical9.1
Oct 20, 2026
Critical [CVE-2026-101296] Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms
Critical9.1
Oct 20, 2026
High [CVE-2026-90800] Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed _user or _replicator database via an unauthorised API endpoint
High8.1
Oct 20, 2026
High [CVE-2026-90797] unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion
High7.7
Oct 20, 2026
High [CVE-2026-108089] ** UNSUPPORTED WHEN ASSIGNED ** Exposure of sensitive system information to an unauthorized control sphere vulnerability in Apache Cocoon
High7.5
Oct 20, 2026
Medium [CVE-2026-107755] Insufficient filtering of credentials in the _replicator database in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to read replication credentials of other users’ replications, not just their own
Medium6.0
Oct 20, 2026
Low [CVE-2026-90799] Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory exhaustion
Low1.3
Oct 20, 2026
Low [CVE-2026-90798] missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of service via creating an infinite HTTP redirect loop
Low0.6
Oct 20, 2026
Advisory [CVE-2026-93446] Apache Tomcat: Possible TLS 1.3 connection failures
Unrated
Oct 20, 2026
Advisory [CVE-2026-88041] Apache Tomcat: HTTP/2 trailer header cross-contamination
Unrated
Oct 20, 2026
Advisory [CVE-2026-80353] Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector
Unrated
Oct 20, 2026
Advisory [CVE-2026-74049] Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)
Unrated
Oct 20, 2026
Advisory [CVE-2026-74048] Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up
Unrated
Oct 20, 2026
Advisory [CVE-2026-108088] Apache Cocoon: Cross-user cache poisoning
Unrated
Oct 20, 2026
Advisory [CVE-2026-108087] Apache Cocoon: SQL Injection
Unrated
Oct 20, 2026
Advisory [CVE-2026-108086] Apache Cocoon: XEE could lead to SSRF and information disclosure
Unrated
Oct 20, 2026
Advisory [CVE-2026-92287] Apache Arrow C++, PyArrow: Parquet file-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation
Unrated
Oct 20, 2026
Advisory [CVE-2026-86467] Apache Airflow Amazon provider: AWS auth manager: SAML login CSRF logs users into the attacker's account
Unrated
Oct 19, 2026
Critical [CVE-2026-71253] Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzon
Critical9.8
Oct 19, 2026
Critical [CVE-2026-43865 +1] Deserialization of Untrusted Data vulnerability in Apache Camel
Critical10.0
Oct 19, 2026
Critical [CVE-2026-90910] Missing authentication for critical function vulnerability in Apache Answer
Critical9.8
Oct 19, 2026
High [CVE-2026-88900] Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component
High8.8
Oct 19, 2026
High [CVE-2026-88901] Improper Restriction of XML External Entity Reference vulnerability in Apache Camel
High8.2
Oct 19, 2026
High [CVE-2026-85251] Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP component
High7.5
Oct 19, 2026
High [CVE-2026-85250] Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component
High7.5
Oct 19, 2026
High [CVE-2026-83531] Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel
High8.8
Oct 19, 2026
High [CVE-2026-80344] Server-Side Request Forgery (SSRF) vulnerability in Apache Camel AS2 component
High8.2
Oct 19, 2026
High [CVE-2026-80343] Improper Handling of Case Sensitivity vulnerability in Apache Camel Netty HTTP component
High8.2
Oct 19, 2026
High [CVE-2026-80312] Improper Authentication vulnerability in Apache Camel OAuth component
High8.2
Oct 19, 2026
High [CVE-2026-79986] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Azure Files component
High7.4PoC reported
Oct 19, 2026
High [CVE-2026-79985] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel SMB component
High7.4PoC reported
Oct 19, 2026
High [CVE-2026-79984] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Mina SFTP component
High7.4
Oct 19, 2026
High [CVE-2026-79983] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel FTP component
High7.4
Oct 19, 2026
High [CVE-2026-78165] Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis component
High8.8
Oct 19, 2026
High [CVE-2026-78164] Improper Neutralization of Special Elements Used in a Template Engine and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP, Netty HTTP, Undertow and Vert.x HTTP components
High8.2
Oct 19, 2026
Medium [CVE-2026-91858] FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through TransformerFactory.newInstance and enabling only FEATURE_SECURE_PROCESSING before running an identity transform over the body
Medium6.5
Oct 19, 2026
Medium [CVE-2026-85317] Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP component
Medium4.8
Oct 19, 2026
Medium [CVE-2026-85316] Insufficient Granularity of Access Control vulnerability in Apache Camel Platform HTTP component
Medium4.8
Oct 19, 2026
Medium [CVE-2026-85315] Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel gRPC component
Medium5.3
Oct 19, 2026
Medium [CVE-2026-46584 +1] Improper Input Validation vulnerability in Apache Camel Mail component
Medium6.5
Oct 19, 2026
Medium [CVE-2026-85313] Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Jetty component
Medium4.3
Oct 19, 2026
Medium [CVE-2026-85312] Improper Input Validation vulnerability in Apache Camel Core component
Medium4.8
Oct 19, 2026
Medium [CVE-2026-85300] Incorrect Default Permissions vulnerability in Apache Camel PQC component
Medium5.5
Oct 19, 2026
Medium [CVE-2026-85301] Improper Authentication vulnerability in Apache Camel Keycloak component
Medium4.8
Oct 19, 2026
Medium [CVE-2026-85296] Exposure of Data Element to Wrong Session vulnerability in Apache Camel AS2 component
Medium6.5
Oct 19, 2026
Medium [CVE-2026-85260] Insertion of Sensitive Information into Log File vulnerability in Apache Camel MLLP component
Medium5.5
Oct 19, 2026
Medium [CVE-2026-85257] Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CXF component
Medium5.3
Oct 19, 2026
Medium [CVE-2026-85254] Improper Handling of Case Sensitivity vulnerability in Apache Camel Platform HTTP component
Medium6.5
Oct 19, 2026
Medium [CVE-2026-85249] Improper Input Validation vulnerability in Apache Camel Tika component
Medium6.5
Oct 19, 2026
Medium [CVE-2026-85248] Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Camel PQC component
Medium5.9
Oct 19, 2026
Medium [CVE-2026-85247] Improper Certificate Validation vulnerability in Apache Camel Knative component
Medium5.9
Oct 19, 2026
Medium [CVE-2026-85246] Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Mina component
Medium5.3
Oct 19, 2026
Medium [CVE-2026-85245] Exposure of Data Element to Wrong Session vulnerability in Apache Camel Thrift component
Medium5.9
Oct 19, 2026
Medium [CVE-2026-85243] Improper Validation of Integrity Check Value vulnerability in Apache Camel Crypto PGP component
Medium5.9
Oct 19, 2026
Medium [CVE-2026-84181] Improper Authentication vulnerability in Apache Camel Shiro component
Medium5.9
Oct 19, 2026
Medium [CVE-2026-84180] Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Knative component
Medium5.3
Oct 19, 2026
Medium [CVE-2026-84178] Cross-Site Request Forgery (CSRF) vulnerability in Apache Camel OAuth component
Medium6.1
Oct 19, 2026
Medium [CVE-2026-84176] Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Platform HTTP Vertx component
Medium6.5
Oct 19, 2026
Medium [CVE-2026-78163] Server-Side Request Forgery (SSRF), Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel Docling component
Medium5.9
Oct 19, 2026
Advisory [CVE-2026-86589] Apache Answer: User Center integration does not revoke first-login sessions after central account suspension
Unrated
Oct 19, 2026
Advisory [CVE-2026-79633] Apache Answer: Missing Authorization Allows Mutations of Non-Public Content
Unrated
Oct 19, 2026
Advisory [CVE-2026-79624] Apache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation
Unrated
Oct 19, 2026
Advisory [CVE-2026-79620] Apache Answer: Improper Authorization Allows Disclosure of Non-Public Question Metadata
Unrated
Oct 19, 2026
Advisory [CVE-2026-79613] Apache Answer: Disclosure of Comments on Non-Public Content Through Public Profiles
Unrated
Oct 19, 2026
Advisory [CVE-2026-76994] Apache Answer: Exposure of Hidden Question Metadata Through Public Answer Profiles
Unrated
Oct 19, 2026
Advisory [CVE-2026-71563] Apache Answer: MCP Answer Retrieval Exposes Content from Non-Public Questions
Unrated
Oct 19, 2026
Advisory [CVE-2026-68482] Apache Answer: Improper Authorization in Question Invite User Lookup
Unrated
Oct 19, 2026
Advisory [CVE-2026-67249] Apache Answer: Email Code Purpose Confusion May Allow Account Takeover
Unrated
Oct 19, 2026
Advisory [CVE-2026-64945] Apache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions
Unrated
Oct 19, 2026
Advisory [CVE-2026-64944] Apache Answer: Stored XSS via unsanitized HTML in imported question content
Unrated
Oct 19, 2026
Advisory [CVE-2026-64943] Apache Answer: API keys logged in plaintext during authentication
Unrated
Oct 19, 2026
Advisory [CVE-2026-108837] Apache Kylin: Potential computed-column resource exhaustion
Unrated
Oct 19, 2026
Advisory [CVE-2026-108833] Apache Kylin: default startup profile miss security settings
Unrated
Oct 19, 2026
Advisory [CVE-2026-108823] Apache Kylin: Potential unauthenticated job metadata replacement
Unrated
Oct 19, 2026
Advisory [CVE-2026-108780] Apache Kylin: Potential JDBC source configuration validation issue
Unrated
Oct 19, 2026
Advisory [CVE-2026-108776] Apache Kylin: tables/names SparkSQL injection
Unrated
Oct 19, 2026
Advisory [CVE-2026-108771] Apache Kylin: unauthenticated broadcast API and polymorphic deserialization
Unrated
Oct 19, 2026
Advisory [CVE-2026-108766] Apache Kylin: missing JDBC-config authorization
Unrated
Oct 19, 2026
Advisory [CVE-2026-108764] Apache Kylin: job-driver UI proxy SSRF
Unrated
Oct 19, 2026
Advisory [CVE-2026-108762] Apache Kylin: delete metadata backup path-confinement bypass
Unrated
Oct 16, 2026
High [CVE-2026-63618] Exposure of Sensitive Information (system level configuration info) to an Unauthorized Actor vulnerability in Apache Kylin
High7.5
Oct 16, 2026
Advisory [CVE-2026-108743] Apache Kylin: spark job OS command injection
Unrated
Oct 16, 2026
Advisory [CVE-2026-108709] Apache Kylin: Unauthenticated Metadata Broadcast (inside in-house network)
Unrated
Oct 16, 2026
Advisory [CVE-2026-69080] Apache Kylin: Broken Access Control in QuerySQLBlacklistController
Unrated
Oct 16, 2026
Advisory [CVE-2026-69077] Apache Kylin: JobController allows unauthorized cross-project manipulation
Unrated
Oct 16, 2026
Advisory [CVE-2026-69076] Apache Kylin: Unauthorized cross-project job discard
Unrated
Oct 16, 2026
Advisory [CVE-2026-68573] Apache Kylin: Unauthenticated Metastore Cleanup
Unrated
Oct 16, 2026
Advisory [CVE-2026-68572] Apache Kylin: Unauthorized SQL execution to Spark SQL env
Unrated
Oct 16, 2026
Advisory [CVE-2026-68571] Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin
Unrated
Oct 16, 2026
Advisory [CVE-2026-64959] Apache Kylin: Missing authentication on certain cache API endpoints
Unrated
Oct 16, 2026
Advisory [CVE-2026-64610] Apache Kylin: Redis unsafe Java deserialization
Unrated
Oct 16, 2026
Advisory [CVE-2026-63619] Apache Kylin: Missing authorization and path-confinement on system meta dump
Unrated
Oct 15, 2026
Critical [CVE-2026-94134 +1] The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it accepts any server key
Critical9.1

Page 2 of 4 · 100 of 348

Get an email when Apache publishes the next one.

See Apache's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about Apache

Dates are each advisory's publication date at the source, in UTC; a record with no source date is filed under the day VulniPulse first saw it.