CVE-2026-94650 is a high-severity vulnerability in Apache Thrift's c_glib bindings caused by uncontrolled recursion. This flaw affects all versions before 0.25.0. The Apache Software Foundation has fixed the issue in version 0.25.0. Users are advised to upgrade to this version to mitigate the risk.
Inefficient regular expression complexity, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport.
When an application enables the ZLIB transform for the frames it sends, THeaderTransport::transform() copies the compressed frame into the write buffer without making sure it fits. Data that does not compress, such as content a remote peer supplied, grows under compression, so the copy writes past the end of the heap buffer by an amount that grows with the size of the frame, and for large frames it also reads past the end of the transform buffer.
This issue affects Apache Thrift: before 0.25.0.
Users are recommended to upgrade to version 0.25.0, which fixes the issue.
CVE-2026-79768 is a medium severity vulnerability in Apache HTTP Server's mod_userdir module affecting versions 2.4.0 through 2.4.68. It involves a path equivalence issue with the '/./' (single dot directory) sequence when the UserDir directive is configured with an absolute non-wildcard path. This flaw could allow information disclosure due to improper path handling.
CVE-2026-58415 is a vulnerability in Apache HTTP Server versions 2.4.0 through 2.4.68 where internal state files related to WebDAV dead properties are accessible to remote clients. This occurs due to mod_dav_fs allowing GET requests to the .DAV state directory, exposing information about resources the client cannot author. The vulnerability has a medium severity with a CVSS score of 5.3.
CVE-2026-56153 is a high-severity out-of-bounds write vulnerability in the mod_charset_lite module of Apache HTTP Server versions 2.4.0 through 2.4.68. This vulnerability could lead to memory corruption and potentially impact confidentiality. There are no known exploits reported in the wild at this time.
CVE-2026-48005 is a high-severity vulnerability in Apache HTTP Server versions 2.4.0 through 2.4.68. It involves missing authentication checks in the mod_auth_digest module when Digest authentication is enabled with the AuthDigestNcCheck option. This flaw allows unauthenticated remote attackers to cause a denial of service by forcing re-authentication via forged Authorization headers. The issue is fixed in version 2.4.69.
CVE-2026-47360 is a high-severity vulnerability in Apache HTTP Server's mod_session_cookie module affecting versions 2.4.0 through 2.4.68. The flaw allows exposure of sensitive session cookie information to unauthorized actors due to improper handling of the SessionCookieRemove setting during internal redirects. This can result in session cookies being passed incorrectly to backend servers.
CVE-2026-46729 is a NULL Pointer Dereference vulnerability in the Apache HTTP Server's mod_heartmonitor module when using the unicast listener. It affects Apache HTTP Server versions from 2.4.0 through 2.4.68. This vulnerability can cause a denial of service by crashing the server. The CVSS score is 7.5, indicating a high severity impact due to availability disruption.
CVE-2026-42528 is a medium severity vulnerability in Apache HTTP Server up to version 2.4.68. It is caused by a memory allocation bug in the mod_dav module that allows an attacker with permission to create WebDAV locks to crash server child processes. The vulnerability is fixed in version 2.4.69.
CVE-2026-42356 is a vulnerability in Apache HTTP Server versions 2.4.60 through 2.4.68 where an internal redirect from CGI programs may cause the target to be incorrectly treated and executed as a CGI script. This occurs if the target is in a CGI-enabled directory and lacks another mod_mime-recognized extension. The vulnerability has a low severity rating with a CVSS score of 3.7.
Improper Authentication vulnerability in Apache APISIX.
On a route using openid-connect plugin with remote introspection against an authorization server that serves multiple issuers, a token that introspects as active for one issuer may get accepted on a route restricted to another. This issue affects Apache APISIX: from 3.12.0 through 3.18.0.
Users are recommended to upgrade to version 3.19.0, which fixes the issue.
Use of Non-Canonical URL paths for authorization decisions vulnerability in Apache APISIX.
In some configurations where a permissive route overlaps a protected one, a crafted encoded path can reach an upstream endpoint that the matched route's policies were never meant to cover. A request that should have been rejected is served instead, giving unauthenticated access to a protected upstream endpoint. This issue affects Apache APISIX: from 2.14.1 through 3.18.0.
Users are recommended to upgrade to version 3.19.0, which fixes the issue.
Allocation of resources without limits or throttling vulnerability in batch-requests plugin in Apache APISIX.
An unauthenticated caller can drive a gateway worker into OOM via a route where the batch-requests plugin is used and the batch endpoint is publicly exposed. This issue affects Apache APISIX: from 1.3.0 through 3.18.0.
Users are recommended to upgrade to version 3.19.0, which fixes the issue.
Cross-Site request forgery (CSRF) vulnerability in feishu-auth and dingtalk-auth plugins in Apache APISIX.
An attacker who can get a user to click a crafted link may cause that user's browser session on a protected route to be established under the attacker's identity instead of their own. Any work the user then performs in that session, including uploads, form submissions, and account bindings, lands in the attacker's account. This issue affects Apache APISIX: from 3.17.0 through 3.18.0.
Users are recommended to upgrade to version 3.19.0, which fixes the issue.
Improper verification of cryptographic signature vulnerability in Apache APISIX.
Any unauthenticated attacker could impersonate any user on every route protected by the saml-auth plugin under default configuration. This issue affects Apache APISIX: from 3.17.0 through 3.18.0.
Users are recommended to upgrade to version 3.19.0, which fixes the issue.
Exposure of data element to wrong session vulnerability in Apache APISIX.
This issue affects Apache APISIX: from 2.3.0 before 3.7.0.
Under a supported authz-keycloak configuration, a request's authorization scope could persist into later requests on the same route, leading to unintended authorization expansion and inconsistent access-control decisions.
Users are recommended to upgrade to version 3.7.0 or higher, which fixes the issue.
Insertion of sensitive information into log file vulnerability in Apache APISIX.
This vulnerability can cause the unmasked header value to be written to the log sink under a certain response structure.
This issue affects Apache APISIX: 3.17.0.
Users are recommended to upgrade to version 3.18.0, which fixes the issue.
Improper Restriction of XML External Entity Reference in the XSLT support extension (camel-quarkus-support-xalan) in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or issue requests to internal network locations via an external entity declaration in that document.
The extension supplies its own Xalan-backed TransformerFactory to the xslt component and registers it as the JAXP default. Xalan-J 2.7.x predates JAXP 1.5 and does not honour javax.xml.XMLConstants.ACCESS_EXTERNAL_DTD or ACCESS_EXTERNAL_STYLESHEET, so the external access restrictions Apache Camel applies to the TransformerFactory it creates were not in effect. On the xslt component path this affects message bodies that reach the transformer already as a javax.xml.transform.Source; bodies of other types are converted to a SAXSource by Apache Camel with external entities and external DTD loading disabled, and are not affected. Because the factory is also the JAXP default, other code in the application obtaining one through TransformerFactory.newInstance() loses the same restrictions without error.
Applications are affected if they use any of camel-quarkus-xslt, camel-quarkus-xslt-saxon, camel-quarkus-tika or camel-quarkus-xmlsecurity, each of which brings the XSLT support extension onto the classpath. For all but camel-quarkus-xslt, the exposure is limited to the JAXP default factory, since those extensions do not perform XSLT transformations themselves.
Users are recommended to upgrade to version 3.33.3 or 3.40.0, which fixes this issue.
CVE-2026-92899 is a medium severity vulnerability in Apache WSS4J where the Nonce value in UsernameTokens is stored as raw base64 text, but authentication uses decoded bytes. This allows an attacker who captures an authenticated request to modify the Nonce by adding a space, bypassing the replay cache and reusing the token until it expires. The issue affects deployments with a nonce replay cache configured and tokens using password digest. Fixed versions are 4.0.2, 3.0.6, and 2.4.4.