Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Apache APISIX — Vulnerabilities & Security Advisories 11

All 11 CVE vulnerabilities found in Apache APISIX, with AI-generated Chinese analysis, references, and POCs.

Vendor: Apache Software Foundation

CVE IDTitleCVSSSeverityPublished
CVE-2026-31923 Apache APISIX: Openid-connect `tls_verify` field is disabled by default CWE-319 7.5 -2026-04-14
CVE-2026-31924 Apache APISIX: Plugin tencent-cloud-cls log export uses plaintext HTTP CWE-319 7.5 -2026-04-14
CVE-2026-31908 Apache APISIX: forward auth plugin allows header injection CWE-75 8.2 -2026-04-14
CVE-2025-62232 Apache APISIX: basic-auth logs plaintext credentials at info level CWE-532 6.5 -2025-10-31
CVE-2025-46647 Apache APISIX: improper validation of issuer from introspection discovery url in plugin openid-connect CWE-302 7.5AIHighAI2025-07-02
CVE-2024-32638 Apache APISIX: Forward-Auth Request Smuggling CWE-444 9.1 -2024-05-02
CVE-2022-29266 apisix/jwt-auth may leak secrets in error response CWE-209 7.5 -2022-04-20
CVE-2022-25757 Apache APISIX: the body_schema check in request-validation plugin can be bypassed CWE-20 9.8 -2022-03-28
CVE-2022-24112 apisix/batch-requests plugin allows overwriting the X-REAL-IP header CWE-290 9.8 -2022-02-11
CVE-2021-43557 Path traversal in request_uri variable 9.1 -2021-11-22
CVE-2020-13945 Apache Apisix 安全漏洞 6.5 -2020-12-07

All 11 known CVE vulnerabilities affecting Apache APISIX with full Chinese analysis, references, and POCs where available.