security@apache.org
organization01
roles
Roles this identity holds.
02
references
Other names and identifiers for this entity.
nvdUS security@apache.org
03
assessed vulnerabilities (477)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-113582US | — | — | ||
UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests when an a… | ||||
| CVE-2026-112381US | — | — | ||
Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origin response is being reparsed from a reen… | ||||
| CVE-2026-111817US | — | — | ||
Apache Traffic Server can stall a chunked transfer that it passes through with its trailers removed (proxy.config.http.drop_chunked_trailers) until the connection times out, becaus… | ||||
| CVE-2026-111815US | — | — | ||
Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verify_client STRICT policy.
Thi… | ||||
| CVE-2026-111814US | — | — | ||
Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a d… | ||||
| CVE-2026-111812US | —OT elevated | — | ||
Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials.
This issue affects Apache… | ||||
| CVE-2026-111811US | —OT elevated | — | ||
Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache.
This issue affects Apache Traffic Serv… | ||||
| CVE-2026-111810US | — | — | ||
Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a request carrying many such headers makes the… | ||||
| CVE-2026-111809US | — | — | ||
Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1… | ||||
| CVE-2026-111808US | — | — | ||
Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame.
This issue affects Apache Traffic Server: from 8.0.0 thro… | ||||
| CVE-2026-111805US | — | — | ||
Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value.
This issue affects Apache Traffic Server: from 8.0.0 t… | ||||
| CVE-2026-111816US | — | — | ||
Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out bypassed the rejection pa… | ||||
| CVE-2026-111813US | — | — | ||
Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) configuration.
This issue affec… | ||||
| CVE-2026-111804US | — | — | ||
Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API.… | ||||
| CVE-2026-105945US | — | — | ||
The Pulsar Packages Management Service can be configured to store packages on the local filesystem of the broker by using the filesystem storage provider. Package names consist of… | ||||
| CVE-2026-105944US | —OT elevated | — | ||
Apache Pulsar Manager is a web console for administering Apache Pulsar clusters. It has its own user accounts and login, and it can be configured with an HTTP authentication creden… | ||||
| CVE-2026-105942US | —OT elevated | — | ||
When a configured proxy role sends a request to the broker on behalf of another user (the original principal), the broker is designed to authorize both the proxy role and the origi… | ||||
| CVE-2026-105938US | —OT elevated | — | ||
Apache Pulsar namespaces can restrict which roles may use a subscription, either with the Prefix subscription authentication mode, which requires a subscription name to start with… | ||||
| CVE-2026-105937US | —OT elevated | — | ||
Apache Pulsar shadow topics (PIP-180) are topics that read the stored messages of a source topic from that topic's managed ledger. The source topic is selected by setting the reser… | ||||
| CVE-2026-105936US | —OT elevated | — | ||
The Pulsar Functions worker REST API provides two endpoints that return the catalog of Pulsar IO connectors installed on the functions worker: the worker connectors endpoint (/admi… | ||||