Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

Apache Software Foundation — Vulnerabilities & Security Advisories 2370

Browse all 2370 CVE security advisories affecting Apache Software Foundation. AI-powered Chinese analysis, POCs, and references for each vulnerability.

The Apache Software Foundation develops and maintains open-source software, primarily known for the widely deployed Apache HTTP Server and foundational Java frameworks. Its extensive portfolio exposes a significant attack surface, evidenced by the 1717 recorded CVEs. Historically, vulnerabilities frequently involve remote code execution, cross-site scripting, and privilege escalation, often stemming from complex configuration errors or input validation failures in legacy components. While the foundation enforces rigorous security review processes, the sheer volume of projects increases the likelihood of undiscovered flaws. Notable incidents include critical flaws in Log4j, which allowed remote code execution via crafted log messages, highlighting risks in dependency management. The organization relies on community-driven patching, requiring administrators to promptly apply updates to mitigate exploitation. This model ensures transparency but demands active vigilance from users to maintain system integrity against evolving threat vectors.

Top products by Apache Software Foundation: Apache Airflow Apache Tomcat Apache HTTP Server Apache Traffic Server Apache Superset Apache OFBiz Apache CloudStack Apache Camel Apache NiFi Apache CXF Apache InLong Apache Syncope Apache DolphinScheduler Apache Struts Apache Thrift Apache APISIX Apache OpenOffice Apache Zeppelin Apache IoTDB Apache Answer Apache Solr Apache OpenMeetings Apache Ranger Apache JSPWiki Apache Wicket Apache Fineract Apache ActiveMQ Apache Kylin Apache Hadoop Apache Hive
CVE ID Title CVSS Severity Published
CVE-2021-33192 Display information UI XSS — Apache Jena Fuseki CWE-79 6.1 - 2021-07-05
CVE-2021-26920 Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended — Apache Druid 6.5 - 2021-07-02
CVE-2021-35474 Dynamic stack buffer overflow in cachekey plugin — Apache Traffic Server CWE-121 9.8 - 2021-06-30
CVE-2021-32567 Reading HTTP/2 frames too many times — Apache Traffic Server CWE-20 7.5 - 2021-06-30
CVE-2021-32566 Specific sequence of HTTP/2 frames can cause ATS to crash — Apache Traffic Server CWE-20 7.5 - 2021-06-30
CVE-2021-32565 HTTP Request Smuggling, content length with invalid charters — Apache Traffic Server CWE-444 7.5 - 2021-06-29
CVE-2021-27577 Incorrect handling of url fragment leads to cache poisoning — Apache Traffic Server CWE-444 7.5 - 2021-06-29
CVE-2021-26461 malloc, realloc and memalign implementations are vulnerable to integer wrap-arounds — Apache NuttX CWE-190 9.8 - 2021-06-21
CVE-2021-30468 Apache CXF Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter — Apache CXF CWE-400 7.5 - 2021-06-16
CVE-2020-9493 Java deserialization in Chainsaw — Apache Chainsaw CWE-502 9.8 - 2021-06-16
CVE-2021-31618 NULL pointer dereference on specially crafted HTTP/2 request — Apache HTTP Server CWE-476 7.5 - 2021-06-15
CVE-2021-31811 A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading a tiny file — Apache PDFBox CWE-789 5.5 - 2021-06-12
CVE-2021-31812 A carefully crafted PDF file can trigger an infinite loop while loading the file — Apache PDFBox CWE-834 5.5 - 2021-06-12
CVE-2021-30641 Unexpected URL matching with 'MergeSlashes OFF' — Apache HTTP Server 5.3 - 2021-06-10
CVE-2021-26691 Apache HTTP Server mod_session response handling heap overflow — Apache HTTP Server CWE-122 9.8 - 2021-06-10
CVE-2021-26690 mod_session NULL pointer dereference — Apache HTTP Server 7.5 - 2021-06-10
CVE-2020-13950 mod_proxy_http NULL pointer dereference — Apache HTTP Server 7.5 - 2021-06-10
CVE-2020-35452 mod_auth_digest possible stack overflow by one nul byte — Apache HTTP Server 9.4 - 2021-06-10
CVE-2020-13938 Improper Handling of Insufficient Privileges — Apache HTTP Server 5.5 - 2021-06-10
CVE-2019-17567 mod_proxy_wstunnel tunneling of non Upgraded connections — Apache HTTP Server - - 2021-06-10
CVE-2021-33190 Bypass network access control — Apache APISIX Dashboard CWE-307 5.3 - 2021-06-08
CVE-2021-30180 Apache Dubbo RCE on customers via Condition route poisoning (Unsafe YAML unmarshaling) — Apache Dubbo 9.8 - 2021-05-31
CVE-2021-30179 Apache Dubbo Pre-auth RCE via Java deserialization in the Generic filter — Apache Dubbo 9.8 - 2021-05-31
CVE-2021-25640 Open Redirect or SSRF vulnerability usage of parseURL — Apache Dubbo CWE-918 8.2 - 2021-05-31
CVE-2021-25641 Dubbo Zookeeper does not check serialization id — Apache Dubbo 9.8 - 2021-05-29
CVE-2021-30181 Apache Dubbo RCE on customers via Script route poisoning (Nashorn script injection) — Apache Dubbo 9.8 - 2021-05-29
CVE-2020-17514 disabled hostname verificiation — Apache Fineract 7.4 - 2021-05-27
CVE-2021-22160 Authentication with JWT allows use of “none”-algorithm — Apache Pulsar 9.8 - 2021-05-26
CVE-2021-23937 DNS proxy and possible amplification attack — Apache Wicket 7.5 - 2021-05-25
CVE-2021-31164 Apache Unomi log injection — Apache Unomi CWE-93 9.1 - 2021-05-04

This page lists every published CVE security advisory associated with Apache Software Foundation. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.