CVE Intelligence

Apache Software Foundation vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Apache Software Foundation products: 1279 record(s), with severity, exploitation and fixes.

Tomcat 124Thrift 86Airflow 72Camel 58Apache HTTP Server 54Traffic Server 43Apache ActiveMQ 41Cxf 38Syncope 34Apisix 29Cloudstack 29Struts 27Ofbiz 24Dolphinscheduler 23Apache ActiveMQ All 20Kylin 19Apache Roller 18Nifi 17Iotdb 16Apache ActiveMQ Broker 15Wicket 15Answer 14Mina Sshd 14Allura 13Qpid Broker-j 13Ranger 12Log4j 11Shiro 11Jmeter 11Neethi 11Fory 10Artemis 10Nimble 10Inlong 10Apache ActiveMQ Artemis 9Superset 8Apache-airflow-providers-fab 8Openoffice 8Zookeeper 8Karaf 8

Exploited only (KEV) →

CVE-2026-58181 High · 7.5 CWE-121 Jul 29, 2026
Apache Traffic Server: uri_signing and url_sig plugins can exhaust the stack or crash
The Apache Traffic Server uri_signing and url_sig plugins can exhaust the stack or crash on attacker input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
CVE-2026-58180 High · 7.5 CWE-121 Jul 29, 2026
Apache Traffic Server: txn_box plugin overflows the stack from attacker input
The Apache Traffic Server txn_box plugin overflows the stack from attacker-controlled input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
CVE-2026-58179 Critical · 9.8 CWE-121 Jul 29, 2026
Apache Traffic Server: regex_remap plugin overflows the stack from attacker input
The Apache Traffic Server regex_remap plugin overflows the stack and integers from substitution input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
CVE-2026-58178 High · 7.5 CWE-674 Jul 29, 2026
Apache Traffic Server: ESI plugin allows uncontrolled recursion and server-side request forgery
The Apache Traffic Server ESI plugin can recurse without bound and fetch attacker-controlled URLs. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
CVE-2026-58177 Critical · 9.8 CWE-787 Jul 29, 2026
Apache Traffic Server: Memory-safety and path-traversal errors in the Cripts framework
The Apache Traffic Server Cripts framework has out-of-bounds writes, path traversal, and use-after-free errors. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 10.1.4, which fix the issue.
CVE-2026-58175 High · 7.5 CWE-401 Jul 29, 2026
Apache Traffic Server: HostDB SRV handling leaks memory
Apache Traffic Server leaks memory when handling HostDB SRV records. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
CVE-2026-58164 High · 7.5 CWE-416 Jul 29, 2026
Apache Traffic Server: Remap configuration lifetime and TOCTOU errors cause use-after-free
Apache Traffic Server has use-after-free and time-of-check/time-of-use errors in remap configuration handling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
CVE-2026-58163 Critical · 9.1 CWE-502 Jul 29, 2026
Apache Traffic Server: Cache deserialization and lifetime errors can corrupt state or crash the server
Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
CVE-2026-58162 Critical · 10.0 CWE-295 Jul 29, 2026
Apache Traffic Server: Certifier plugin trusts client SNI when generating certificates
The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
CVE-2026-58161 High · 7.5 CWE-476 Jul 29, 2026
Apache Traffic Server: Memory-safety errors in TLS and SNI handling can crash the server
Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
CVE-2026-58160 Medium · 6.5 CWE-125 Jul 29, 2026
Apache Traffic Server: Out-of-bounds reads while parsing DNS responses
Apache Traffic Server reads out of bounds while parsing DNS answers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
CVE-2026-58159 High · 8.2 CWE-863 Jul 29, 2026
Apache Traffic Server: Listener and ACL handling allow access-control bypass
Apache Traffic Server can bypass IP access controls on UDS listeners and through ACL matching errors. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
CVE-2026-58158 Medium · 5.9 CWE-121 Jul 29, 2026
Apache Traffic Server: PROXY protocol parsing has port truncation and a stack overflow
Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
CVE-2026-58157 High · 8.7 CWE-200 Jul 29, 2026
Apache Traffic Server: Improper server-session reuse can expose data across client connections
Apache Traffic Server can reuse server sessions and tunnels improperly, exposing data across client connections. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
CVE-2026-50622 High · 8.8 CWE-862 Jul 29, 2026
Apache Atlas: Missing Authorization on Admin Endpoints
Description: Missing Authorization in Apache Atlas. A missing authorization vulnerability in Apache Atlas's admin endpoints allows any authenticated user, regardless of their assigned role, to perform administrative operations. Affect Version: This issue affects Apache Atlas: from 0.8 through 2.5.0. Mitigation: Users are recommended to upgrade to version 2.6.0, which fixes the issue.
CVE-2026-23904 High · 7.3 CWE-923 Jul 29, 2026
Apache Kyuubi: Unrestricted access via Kyuubi engine-ui proxy
Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination. A remote requester with network access to the proxy can cause the Kyuubi server to send HTTP requests to arbitrary reachable hosts, resulting in SSRF or open-proxy behavior. This issue affects Apache Kyuubi: from 1.8.0 before 1.12.0. Users are recommended to upgrade to version 1.12.0, which disables the proxy by default. To restore proxied Engine UI, set kyuubi.frontend.rest.engine.ui.proxy.enabled=true and configure allowed target hosts with kyuubi.frontend.rest.engine.ui.proxy.hosts.
CVE-2026-65325 Medium · 4.8 CWE-295 Jul 29, 2026
Apache Traffic Server: HTTP/2 multiplexed origin sessions are reused without certificate re-verification
Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying the server certificate covers the new request hostname. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
CVE-2026-65324 High · 7.5 CWE-400 Jul 29, 2026
Apache Traffic Server: HTTP/2 and HTTP/3 dechunking removes per-stream buffer cap, allowing memory exhaustion
Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow client exhaust server memory. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
CVE-2026-58156 Medium · 4.9 CWE-863 Jul 29, 2026
Apache Traffic Server: URL and port parsing errors allow access-control bypass
Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
CVE-2026-58155 Critical · 9.3 CWE-444 Jul 29, 2026
Apache Traffic Server: Header-name length truncation enables header aliasing and request smuggling
Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
CVE-2026-58154 High · 8.9 CWE-787 Jul 29, 2026
Apache Traffic Server: Memory-safety errors in MIME and header parsing
Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
CVE-2026-58153 High · 8.3 CWE-444 Jul 29, 2026
Apache Traffic Server: HTTP/2 to HTTP/1 conversion forwards origin trailers to clients unsafely
Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when converting HTTP/2 to HTTP/1. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
CVE-2026-58152 Medium · 5.9 CWE-190 Jul 29, 2026
Apache Traffic Server: Integer-handling errors in HPACK/XPACK decoding corrupt memory
Apache Traffic Server mishandles integers while decoding HPACK/XPACK headers, corrupting memory. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
CVE-2026-58151 High · 7.5 CWE-400 Jul 29, 2026
Apache Traffic Server: Abusive HTTP/2 framing can exhaust resources and crash the server
Apache Traffic Server can be crashed or driven to resource exhaustion by abusive HTTP/2 framing and flow-control. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.
CVE-2026-58150 Critical · 10.0 CWE-444 Jul 29, 2026
Apache Traffic Server: HTTP/2 requests with Transfer-Encoding are not rejected, allowing request smuggling
Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade request smuggling. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.