Apache Software Foundation vulnerabilities and threats

Apache Kyuubi versions 1.7.0 through 1.11.1 contain a path traversal vulnerability in the REST batch multipart upload handling. The server uses the client-supplied multipart filename when creating temporary uploaded resources, allowing a remote attacker to write files outside the intended directory if they can access the upload endpoint. This issue is fixed in version 1.12.0.

Apache JSPWiki versions up to 2.12.3 contain a cross-site scripting (XSS) vulnerability due to improper neutralization of script-related HTML tags when parsing markdown rendering errors. This flaw allows an attacker to execute JavaScript in the victim's browser, potentially exposing sensitive information. The issue is fixed in version 2.12.4.

CVE-2026-28814 is a high-severity vulnerability in Apache JSPWiki up to version 2.12.3 that allows arbitrary Wiki Markup rendering due to lack of authentication. This flaw enables an attacker to access sensitive data stored in JSPWiki variables without requiring any privileges. The issue is resolved in versions 2.12.4 and 3.0.0 by introducing proper authentication controls.

Apache JSPWiki versions prior to 2.12.4 are vulnerable to a Cross-Site Request Forgery (CSRF) issue related to JSON Hijacking. This vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user. The issue is fixed in version 2.12.4.

UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to escalate privileges. Users are recommended to upgrade to version 2.12.4 or newer which fixes this issue.

Apache JSPWiki versions prior to 2.12.4 contain a vulnerability where debug messages reveal unnecessary information. This issue is addressed in version 2.12.4. The vulnerability has a high severity score of 7.5 and is identified as CWE-1295.

Apache Zeppelin versions 0.11.1, 0.11.2, and 0.12.0 contain an LDAP injection vulnerability due to improper escaping of special characters in LDAP search filters. This vulnerability is an incomplete fix of a previous issue (CVE-2024-31867). The issue is resolved in version 0.12.1. The CVSS score is 6.5, indicating a medium severity risk.

Apache Zeppelin versions 0.6.0 through 0.12.0 contain an LDAP injection vulnerability in the ActiveDirectoryGroupRealm component. This flaw allows an authenticated attacker to inject LDAP filter syntax via the user-search endpoint and potentially expose directory information. The role-lookup path is also affected after successful LDAP authentication. The issue is fixed in version 0.12.1.

Cross-Site Request Forgery (CSRF) vulnerability in Apache Zeppelin. The default CORS configuration allowed cross-origin state-changing requests and accepted text/plain request bodies, allowing an attacker who lures an authenticated user to a                   malicious site to perform actions on the user's behalf through REST and WebSocket endpoints. This issue affects Apache Zeppelin versions 0.6.0 through 0.12.0. Users are recommended to upgrade to version 0.12.1, which fixes this issue.

Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying the server certificate covers the new request hostname. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

Description: Missing Authorization in Apache Atlas. A missing authorization vulnerability in Apache Atlas's admin endpoints allows any authenticated user, regardless of their assigned role, to perform administrative operations. Affect Version: This issue affects Apache Atlas: from 0.8 through 2.5.0. Mitigation: Users are recommended to upgrade to version 2.6.0, which fixes the issue.

Apache Kyuubi versions from 1.8.0 before 1.12.0 contain a vulnerability in the Engine UI proxy component that allows remote attackers with network access to cause the server to send HTTP requests to arbitrary hosts. This behavior can lead to Server-Side Request Forgery (SSRF) or open-proxy issues. The vulnerability is addressed in version 1.12.0, which disables the proxy by default and requires explicit configuration to enable it safely.

Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded successfully, so an encode failure leaves the encoder out of sync with the peer decoder and corrupts subsequent header blocks on the connection. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

Apache Traffic Server allows redirect-limit bypass when plugins reset the retry counter, enabling SSRF amplification. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

The Apache Traffic Server multiplexer plugin overruns its chunk-decode buffer on upstream input, enabling denial of service. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

The Apache Traffic Server webp_transform plugin can decode unsafely and serve mislabeled, cacheable responses. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

The Apache Traffic Server intercept plugin has a use-after-free. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

The Apache Traffic Server header_rewrite plugin can crash or corrupt memory during cookie operations and CIDR condition matching. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.

The Apache Traffic Server prefetch plugin can crash when processing attacker-influenced input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.