Apache security advisories, October 2026

Every Apache Software Foundation security advisory published in October 2026, from ASF Security ([email protected] CNA) via NVD, with its severity, CVEs and CISA KEV status. Open a record for affected and fixed versions and the vendor's own link.

Advisories: 348
Critical: 34
High: 125
In CISA KEV: 0

Apache advisories published in October 2026

Oct 15, 2026
Medium [CVE-2026-94134 +1] The Apache Airflow SFTP provider's deferrable code paths (`SFTPTrigger`, `SFTPHookAsync`, `SFTPClientPool`) disable SSH host-key verification by default unless the connection explicitly sets `no_host_key_check` to false
Medium4.3
Oct 15, 2026
Medium [CVE-2026-96806] The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but `KeycloakJWTMiddleware` then issued a new, unrevoked token on the same response, so the user stayed logged in
Medium5.8
Oct 15, 2026
Medium [CVE-2026-92228] The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role global read access to audit logs
Medium6.5
Oct 13, 2026
Advisory [CVE-2026-107460 +1] Apache Fesod (Incubating): UrlImageConverter SSRF protection bypass via DNS rebinding
Unrated
Oct 12, 2026
Critical [CVE-2026-92120] OAuth1 Request Replay Attack vulnerability in Apache Allura
Critical9.1
Oct 12, 2026
Critical [CVE-2026-92119] REST API Mass Assignment vulnerability in Apache Allura
Critical9.1
Oct 12, 2026
Critical [CVE-2026-92116] OAuth1 callback validation vulnerability in Apache Allura
Critical9.1
Oct 12, 2026
Critical [CVE-2026-85499] Improper Authorization vulnerability in Apache SkyWalking BanyanDB
Critical9.1PoC reported
Oct 10, 2026
Critical [CVE-2026-103635] Out-of-bounds read in the compact Theta sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp)
Critical9.1
Oct 10, 2026
Critical [CVE-2026-103513] Out-of-bounds read and write in the CPC sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp)
Critical9.8
Oct 10, 2026
Critical [CVE-2026-103501] Heap buffer overflow in the HLL sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp)
Critical9.8
Oct 10, 2026
High [CVE-2026-103636] Out-of-bounds read in the VarOpt union deserialization of Apache DataSketches C++ (repo: datasketches-cpp)
High7.5
Oct 9, 2026
Critical [CVE-2026-107938] In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) did not verify that the hostname in the server’s TLS certificate matched the host being called
Critical9.1
Oct 9, 2026
Critical [CVE-2026-97468] Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated security tokens under a non-cryptographic 32-bit hash of the token (Java Arrays.hashCode/hashCode), and treated a cache hit as proof that the presented token had already been validated
Critical9.1
Oct 9, 2026
Critical [CVE-2026-71575] The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity
Critical9.1
Oct 9, 2026
High [CVE-2026-103413] Improper input validation vulnerability in Apache Camel Karavan
High8.8
Oct 9, 2026
High [CVE-2026-103412] Improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Apache Camel Karavan
High8.8
Oct 9, 2026
High [CVE-2026-108039] By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document
High7.5
Oct 9, 2026
High [CVE-2026-107937] In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max-header-size (default 300 characters) and attachment-headers-max-count (default 500) limits
High7.5
Oct 9, 2026
High [CVE-2026-100227] Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module
High7.5
Oct 9, 2026
High [CVE-2026-97791] In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS
High7.5
Oct 9, 2026
High [CVE-2026-86463] Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions
High7.5
Oct 9, 2026
High [CVE-2026-78384] CompressionUtils.inflate decompressed attacker-controlled DEFLATE data with no output-size cap
High7.5
Oct 9, 2026
High [CVE-2026-73179] Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from a single authorization code via concurrent token exchange requests that race the non-atomic find-then-delete operation against a shared relational database under READ_COMMITTED isolation
High8.1
Oct 9, 2026
Medium [CVE-2026-79650] Apache CXF’s OIDC relying-party component could redirect users to an attacker-controlled URL after successful authentication
Medium6.1
Oct 8, 2026
High [CVE-2026-71895] authorization vulnerability in Apache DolphinScheduler allows authenticated non-admin users to retrieve Kubernetes configuration data intended for administrator-managed cluster configuration
High7.1
Oct 8, 2026
High [CVE-2026-71183] authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information about data sources they are not authorized to access through the /unauth-datasource and /authed-datasource endpoints
High7.1
Oct 8, 2026
High [CVE-2026-66087] authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate task instance in projects they are not authorized to access through the * /dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/stop * /dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/savepoint This issue affects Apache DolphinScheduler: before 3.4.3
High8.1
Oct 8, 2026
High [CVE-2026-66084] authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to modify task definitions in projects they are not authorized to access through the /dolphinscheduler/projects/{projectCode}/task-definition/{code}/with-upstream endpoint
High8.1
Oct 8, 2026
Medium [CVE-2026-71896] authorization vulnerability in Apache DolphinScheduler allows authenticated users to retrieve other users' account information through the /dolphinscheduler/users/list-all endpoint without the required permissions
Medium6.5
Oct 8, 2026
Medium [CVE-2026-66082] authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to perform unauthorized operations on workflow schedules, workflow definitions, and task instances in other projects
Medium6.5
Oct 7, 2026
Critical [CVE-2026-92414] : Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit
Critical9.3
Oct 7, 2026
Critical [CVE-2026-97720] Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4.5.2 which allows attacked to access resources served by the executor's webserver when that webserver is configured to accept JWT/OAuth tokens
Critical9.1
Oct 7, 2026
High [CVE-2026-103371] Insertion of Sensitive Information into Log File in Apache Geode Web Management
High7.5
Oct 7, 2026
Medium [CVE-2026-92415] — Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client
Medium6.9
Oct 7, 2026
Medium [CVE-2026-97146] Apache YuniKorn 1.9.0 and earlier allows bypassing the check for the user annotation by setting a secondary label on the pod
Medium4.8
Oct 7, 2026
Medium [CVE-2026-93684] SQL user using Impala up to and including version 4.5.2 with only SELECT permission can put JavaScript in a table alias and make it run in another user's browser when that user opens the query plan in Impala's Web UI
Medium5.4
Oct 7, 2026
Medium [CVE-2026-90466] Path traversal of 'trusted_jar_paths' in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix matches a path specified in 'trusted_jar_paths'
Medium6.5
Oct 7, 2026
Low [CVE-2026-78243] Apache YuniKorn 1.8.0 and later, if configured with the LDAP group resolver, crashes due to an out of bounds read processing group membership entries.If the LDAP server returns a group membership entry, memberOf attribute, for a user specified in the pod the server crashes if a membership record does not start with "CN="
Low2.1
Oct 7, 2026
Low [CVE-2026-92393] Apache YuniKorn 1.9.0 and earlier does not implement label and user annotation checks for workload UPDATE action bypassing all checks
Low2.0
Oct 6, 2026
High [CVE-2026-94114] Apache Commons: Symbolic name not mapping to correct class
High8.2
Oct 6, 2026
Medium [CVE-2026-105244] Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net
Medium5.3
Oct 6, 2026
Medium [CVE-2026-105243] Insufficient Logging vulnerability in the EventLogAppender of Apache log4net
Medium5.3
Oct 6, 2026
Medium [CVE-2026-105242] Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net
Medium5.3
Oct 6, 2026
Medium [CVE-2026-105241] Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache log4net
Medium5.3
Oct 6, 2026
Medium [CVE-2026-105240] Improper Neutralization of Null Byte or NUL Character vulnerability in the OutputDebugStringAppender of Apache log4net
Medium5.3
Oct 6, 2026
Medium [CVE-2026-105239] Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of Apache log4net
Medium5.3
Oct 6, 2026
Low [CVE-2026-105111] Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Commons BCEL
Low2.3
Oct 5, 2026
Critical [CVE-2026-104711] Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts
Critical9.8
Oct 5, 2026
High [CVE-2026-104714] Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache Struts
High8.8
Oct 5, 2026
High [CVE-2026-104712] Asymmetric resource consumption (amplification) vulnerability in Apache Struts
High7.5
Oct 5, 2026
Medium [CVE-2026-104713] Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin
Medium6.5
Oct 2, 2026
Critical [CVE-2026-83632] Allocation of resources without limits or throttling, Integer overflow or wraparound, Heap-based buffer overflow vulnerability in Apache Thrift
Critical9.2
Oct 2, 2026
Critical [CVE-2026-91135] Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport
Critical9.2
Oct 2, 2026
High [CVE-2026-102795 +1] Improper Access Control vulnerability in Apache Traffic Server
High7.0
Oct 2, 2026
High [CVE-2026-59265] code execution issue in the Java integration in Apache OpenOffice v4.1.16 and earlier allows a crafted untrusted document to trigger executing arbitrary (even remote) code when opened by the user
High8.8
Oct 2, 2026
High [CVE-2026-61374] Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings
High7.1
Oct 2, 2026
High [CVE-2026-63772] Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift go bindings
High8.7
Oct 2, 2026
High [CVE-2026-66055] Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift C++, Java, Go, netstd, Python and Delphi bindings
High8.2
Oct 2, 2026
High [CVE-2026-66081] Access of Uninitialized Pointer vulnerability in Apache Thrift c_glib bindings
High8.7
Oct 2, 2026
High [CVE-2026-66837] Stack-based Buffer Overflow, Integer Overflow or Wraparound vulnerability in Apache Thrift php bindings
High8.7
Oct 2, 2026
High [CVE-2026-66858] The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack
High8.7
Oct 2, 2026
High [CVE-2026-66859] NULL Pointer Dereference, Use of Uninitialized Variable vulnerability in Apache Thrift c_glib bindings
High8.7
Oct 2, 2026
High [CVE-2026-83663] Uncontrolled Recursion vulnerability in Apache Thrift go bindings
High8.7
Oct 2, 2026
High [CVE-2026-83745] Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift nodejs and D lang bindings
High8.7
Oct 2, 2026
High [CVE-2026-85476] Loop with unreachable exit condition ('infinite loop') vulnerability in Apache Thrift c_glib bindings
High8.2
Oct 2, 2026
High [CVE-2026-96289] Uncontrolled Recursion vulnerability in Apache Thrift PHP bindings
High8.2
Oct 2, 2026
High [CVE-2026-96287] Inefficient Algorithmic Complexity vulnerability in Apache Thrift Perl bindings
High8.2
Oct 2, 2026
High [CVE-2026-96286] Uncaught exception vulnerability in Apache Thrift Perl bindings
High8.2
Oct 2, 2026
High [CVE-2026-96277] Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift Ruby bindings
High8.7
Oct 2, 2026
High [CVE-2026-94658] Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings
High8.7
Oct 2, 2026
High [CVE-2026-94657] Allocation of resources without limits or throttling vulnerability in Apache Thrift JavaME bindings
High8.2
Oct 2, 2026
High [CVE-2026-94656] Allocation of resources without limits or throttling vulnerability in Apache Thrift ruby bindings
High8.2
Oct 2, 2026
High [CVE-2026-94655] Allocation of resources without limits or throttling, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings
High8.2
Oct 2, 2026
High [CVE-2026-94654] Loop with unreachable exit condition ('infinite loop') vulnerability in Apache Thrift python bindings
High8.2
Oct 2, 2026
High [CVE-2026-94653] Inefficient Algorithmic Complexity vulnerability in Apache Thrift PHP bindings
High8.2
Oct 2, 2026
High [CVE-2026-94648] Allocation of resources without limits or throttling vulnerability in Apache Thrift dart bindings
High8.2
Oct 2, 2026
High [CVE-2026-94646] Uncaught exception, Improper validation of specified quantity in input, Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift nodejs bindings
High8.7
Oct 2, 2026
High [CVE-2026-94637] Improper handling of highly compressed data (data amplification) vulnerability in Apache Thrift Go bindings
High8.2
Oct 2, 2026
High [CVE-2026-94636] Improper handling of highly compressed data (data amplification), Function call with incorrectly specified arguments, Improper validation of specified quantity in input vulnerability in Apache Thrift py bindings
High8.2
Oct 2, 2026
High [CVE-2026-90440] Uncaught exception, improper handling of exceptional conditions, improper resource shutdown vulnerability in Apache Thrift D thrift.server.nonblocking.TNonblockingServer
High8.2
Oct 2, 2026
High [CVE-2026-87117] NULL pointer dereference vulnerability in Apache Thrift PHP bindings
High8.7
Oct 2, 2026
High [CVE-2026-86537] Uncaught exception, Loop with unreachable exit condition ('infinite loop'), Integer underflow (wrap or wraparound) vulnerability in Apache Thrift D language bindings
High8.7
Oct 2, 2026
High [CVE-2026-86535] Loop with unreachable exit condition ('infinite loop'), Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift NodeJS bindings with TJSONProtocol
High8.7
Oct 2, 2026
High [CVE-2026-82459] Integer underflow (wrap or wraparound), Out-of-bounds write vulnerability in Apache Thrift C++ 32 bit THeaderTransport
High8.2
Oct 2, 2026
High [CVE-2026-82458] Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D language bindings
High8.7
Oct 2, 2026
High [CVE-2026-96288] Uncontrolled Recursion, Allocation of resources without limits or throttling vulnerability in Apache Thrift Erlang bindings
High8.2
Oct 2, 2026
High [CVE-2026-96292] Inefficient regular expression complexity, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings
High8.2
Oct 2, 2026
High [CVE-2026-96294] Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift NodeJS bindings
High8.7
Oct 2, 2026
High [CVE-2026-61373] Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java TSaslNonblockingServer
High8.7
Oct 2, 2026
High [CVE-2026-96990] Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Erlang bindings
High8.2
Oct 2, 2026
High [CVE-2026-94642] Uncaught exception vulnerability in Apache Thrift PHP bindings
High8.7
Oct 2, 2026
High [CVE-2026-94644] Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings
High8.2
Oct 2, 2026
High [CVE-2026-94645] Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability in Apache Thrift nodejs bindings
High8.2
Oct 2, 2026
High [CVE-2026-94650] Uncontrolled Recursion vulnerability in Apache Thrift c_glib bindings
High8.2
Oct 2, 2026
High [CVE-2026-94651] Apache Thrift: Java `TSaslNonblockingServer` `Computation.run` orphans a connection on a pre-auth parse error
High8.2
Oct 2, 2026
High [CVE-2026-85493] Uncontrolled Recursion vulnerability in Apache Thrift Dart and Java ME bindings
High8.7
Oct 2, 2026
High [CVE-2026-85494] Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: Framed transport and binary protocol size read buffers from a peer-declared length without a limit (multi-language)
High8.7
Oct 2, 2026
High [CVE-2026-91137] Improper validation of specified quantity in input, Allocation of resources without limits or throttling, Excessive Iteration vulnerability in Apache Thrift PHP bindings
High8.7
Oct 2, 2026
High [CVE-2026-93925] Stack-based buffer overflow, Incorrect bitwise shift of integer vulnerability in Apache Thrift C++ THeaderProtocol
High8.7

Page 3 of 4 · 100 of 348

Get an email when Apache publishes the next one.

See Apache's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about Apache

Dates are each advisory's publication date at the source, in UTC; a record with no source date is filed under the day VulniPulse first saw it.