Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may lead to a denial of service attack when parsing policies due to runtime memory exhaustion. Users are recommended to upgrade to version 3.2.3, which fixes this issue.
Arbitrary Class Instantiation via XML Feature Generator Descriptor and Format Name in Apache OpenNLP
Versions Affected:
- before 2.5.10
- before 3.0.0-M5
Description:
Three code paths in Apache OpenNLP load a class by its fully-qualified name via Class.forName() and invoke its no-arg constructor without any prior validation of the class name or its type.
The affected paths are:
(1) GeneratorFactory, which reads the class attribute of generator elements in an XML feature generator descriptor; such descriptors are embedded as artifacts in model archives (e.g. TokenNameFinder and POSTagger models) and are parsed during model loading, so an attacker who can supply a crafted model archive controls the class name directly.
(2) StreamFactoryRegistry.getFactory(Class, String), which falls back to interpreting an unregistered format name as the fully-qualified class name of an ObjectStreamFactory; this is exploitable in applications that pass untrusted format names (e.g. exposing the -format parameter of the command-line tooling to external input).
(3) StringInterners, which instantiates the interner implementation named by the opennlp.interner.class system property; this value is normally deployer-controlled, so it is hardened as defense in depth rather than being independently attacker-reachable.
Exploitation requires a class with attacker-useful side effects in its static initializer or no-arg constructor (JNDI lookup, outbound network I/O, filesystem access) to be present on the classpath, so this is not drop-in remote code execution. T
Mitigation:
Upgrade to a fixed release.
The fix routes all three paths through ExtensionLoader.instantiateExtension(...), which consults a package-prefix allowlist before Class.forName() is invoked, so a disallowed class is never loaded, initialized, or constructed.
Classes under the opennlp. prefix remain permitted by default. Deployments that load models referencing feature generator factories, object stream factories, or string interners outside opennlp.* must opt those packages in, either programmatically via ExtensionLoader.registerAllowedPackage(String) before the first model load, or by setting the OPENNLP_EXT_ALLOWED_PACKAGES system property to a comma-separated list of allowed package prefixes.
Users who cannot upgrade immediately should ensure all model files and format names are sourced from trusted origins and should audit their classpath for classes with side-effecting static initializers or constructors.
CVE-2026-60080 is a Use After Free vulnerability in the Rust deserialization logic of Apache Fory. It affects versions from 0.13.0 through 1.3.0. A crafted payload could trigger undefined behavior, process crashes, or potential memory disclosure. Users are advised to upgrade to version 1.4.0, which addresses this issue.
Deserialization of untrusted data vulnerability that may allow class-registration checks to be bypassed during Java lambda deserialization. Only lambda capture class is affected
This issue affects Apache Fory: from before 1.4.0.
Users are recommended to upgrade to version 1.4.0, which fixes the issue.
Out-of-bounds read via sun.misc.Unsafe in Apache Fory. When out-of-band zero-copy deserialization is used, readAlignedVarUint() can read beyond the bounds of the underlying buffer. Out-of-band zero-copy deserialization is an opt-in feature; applications that do not use it are not affected.
This issue affects Apache Fory (formerly Apache Fury): from 0.5.0 before 1.4.0. Versions before 0.11.0 were published under the Maven coordinates org.apache.fury:fury-core.
Users are recommended to upgrade to version 1.4.0, which fixes the issue.
Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deserializing data in compatible mode, the field-skip paths do not correctly validate the declared field types against the actual data, so input with an inconsistent schema can cause type confusion and out-of-bounds memory access. Only the C++ implementation is affected; other language implementations of Apache Fory are not.
This issue affects Apache Fory C++: from 0.14.0 before 1.4.0.
Users are recommended to upgrade to version 1.4.0, which fixes the issue.
A path traversal vulnerability exists in the sshd-scp component of Apache MINA SSHD, allowing malicious senders to write files to arbitrary locations by sending crafted filenames containing paths. This affects applications using unsupported versions prior to 2.0.0 with SCP receive functionality, and applications using sshd-scp in versions 2.0.0 and later. The issue is fixed in Apache MINA SSHD versions 2.19.0 and 3.0.0-M5. Applications not using sshd-scp in versions 2.0.0 and later are not affected.
CVE-2026-56623 is a path traversal vulnerability affecting Apache MINA SSHD's sshd-git component on Windows systems. This flaw allows an authenticated remote user to access git repositories outside the configured server-side root directory due to ineffective path validation on Windows. The issue affects applications using sshd-git on Windows and was fixed in Apache MINA SSHD version 2.19.0 and 3.0.0-M5. Versions 2.0.0 and pre-release 3.0.0-M1 to 3.0.0-M4 are vulnerable.
Apache MINA SSHD versions 2.0.0 through 3.0.0-M1 contain a vulnerability in server-side OpenSSH user certificate validation. The server did not properly check or validate unsupported force-command or verify-required options embedded in user certificates. This allowed a user to authenticate with a certificate containing a force-command option but still execute other commands, depending on server implementation. The issue is fixed in versions 2.19.0 and 3.0.0-M5 by rejecting such certificates.
Improper input validation in sshd-git in Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH.
Component org.apache.sshd:sshd-git provides though its GitPgmCommandFactory a way to configure an Apache MINA SSHD server such that SSH clients can remotely execute git commands via the JGit library on git repositories stored on the server.
This GitPgmCommandFactory allowed a user authenticated via SSH to run any JGit command available, including commands that could write files at arbitrary places such as git archive with the --output option.
Affected are SSH servers implemented with Apache MINA SSHD and using the GitPgmCommandFactory. If the GitPgmCommandFactory is not configured on the server, the server is not affected.
It is recommended to upgrade affected servers to Apache MINA SSHD 2.19.0 or 3.0.0-M5, which fix this issue.
The issue is fixed by restricting the available commands to a small whitelist of uncritical commands (such as git log). git archive is also allowed, but its --output argument is ignored and the archive is always sent through the SSH channel to the client.
Apache Syncope contains a Server-Side Request Forgery (SSRF) vulnerability that allows low-privileged authenticated users to exploit the Connectors and Resources check functionality. This vulnerability affects multiple versions of Apache Syncope from 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1. The issue is resolved in versions 4.0.7 and 4.1.2. The vulnerability has a high severity rating with a CVSS score of 8.1.
Apache Syncope contains an improper privilege management vulnerability (CWE-269) affecting versions from 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1. When configured with certain user workflow adapters and BPMN definitions that do not require admin approval for user self-registration or self-update requests, a REST API call can allow users to grant themselves administrative roles. This results in unauthorized privilege escalation. Upgrading to versions 4.0.7 or 4.1.2 addresses this issue.
CVE-2026-57308 is a critical SQL Injection vulnerability in Apache Syncope that allows an administrator with sufficient privileges to execute arbitrary SQL commands via unsanitized sort parameters. This affects Apache Syncope versions from 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1. The issue is fixed in versions 4.0.7 and 4.1.2. Users should upgrade to these fixed versions to mitigate the risk.
Apache Syncope versions from 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1 contain an improper isolation vulnerability. This flaw allows an administrator with sufficient entitlements to achieve remote code execution via the connector subsystem by exploiting Groovy script execution in scripted connectors. The issue is resolved in versions 4.0.7 and 4.1.2 by hardening the Groovy security sandbox.
Apache Syncope versions from 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1 contain an improper isolation vulnerability. An administrator with sufficient privileges can import BPMN process definitions containing Groovy scriptTasks via the REST API, which execute without sandboxing on the server. This allows arbitrary Groovy code execution with high impact on confidentiality, integrity, and availability. Versions 4.0.7 and 4.1.2 address this issue by sandboxing Groovy scriptTasks.
Apache Syncope contains an improper isolation vulnerability allowing an administrator with Implementation entitlements to create malicious Groovy classes that bypass the Groovy security sandbox. This affects versions from 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1. The issue is fixed in versions 4.0.7 and 4.1.2 by tightening the Groovy sandbox.
Uncontrolled Resource Consumption vulnerability in Apache Traffic Server.
This issue affects Apache Traffic Server: from 9.0.0 through 9.1.13, from 10.0.0 through 10.1.2.
Users are recommended to upgrade to version 9.1.14 or 10.1.3, which fixes the issue.
Improper Handling of Insufficient Privileges vulnerability in Apache Accumulo.
An authenticated, but low-privileged user without system permissions may
issue a remote command to gracefully shutdown system components
(compaction-coordinator, compactor, gc, manager, monitor, tserver, or sserver),
leading to a denial of service.
This issue affects Apache Accumulo 2.1.4 and 2.1.5.
Users are recommended to upgrade to version 2.1.6, which fixes the issue.
The PackagerResolver of Apache Ivy is able to download online
artifacts and to (re)package them in a format defined by a
packager.xml file. This repackaging is done by an Ant script, which is
stored in a subdirectory of the configured "buildRoot" directory. This
subdirectory is calculated based on modules coordinates, like the
organisation, name or version.
If one of the coordinates contains "../" sequences - which are valid
characters for Ivy coordinates in general- it is possible to break out
of the configured "buildRoot" directory where other files can be
overwritten.
In order to exploit this vulnerability an attacker needs to have
access to a packager repository and add or modify the coordinates in
ivy.xml files to have such "../" sequences.
Users of Apache Ivy 2.0.0 to 2.5.3 (inclusive) should upgrade to Ivy 2.6.0.
A SQL Injection vulnerability exists in Apache Fineract's Office Search API (GET /api/v1/offices) in versions up to and including 1.14.0. The orderBy request parameter is concatenated into a SQL query without sufficient validation, allowing an authenticated user with permission to view offices to inject arbitrary SQL via a crafted orderBy value. This is a bypass of the ColumnValidator fix introduced for CVE-2024-32838, which does not detect bare subqueries in the ORDER BY position. This can be leveraged to perform time-based blind SQL injection for data exfiltration. Because the injected query blocks the database connection for its full duration, concurrent exploitation can exhaust the application's database connection pool, resulting in denial of service for other users. Users are recommended to upgrade to a version containing the fix.