CVE Vulnerability Advisory Database

[Affected Scope] Java-based applications and services utilizing Apache Thrift versions prior to 0.24.0

[Impact] Processing maliciously crafted nested messages can trigger a Stack Overflow, leading to an unrecoverable JVM crash and Denial of Service (DoS)

[Mitigation] Immediately upgrade the Apache Thrift Java library dependency to version 0.24.0 or later

[Affected Scope] Inactive Apache MINA 3.0.0 branch and applications utilizing its codec module

[Impact] Unrestricted Remote Code Execution (RCE) via gadget chains due to unfiltered deserialization of frame bytes from untrusted peers

[Mitigation] Decommission the unsupported 3.0.0 branch and migrate to the actively maintained Apache MINA 2.2.X branch

[Affected Scope] Apache Tomcat versions 11.0.20, 10.1.53, and 9.0.116 utilizing clustering with EncryptInterceptor enabled

[Impact] Incomplete fix for CVE-2026-29146 allows attackers to bypass the EncryptInterceptor, leading to the transmission of sensitive session data in plaintext across the network

[Mitigation] Immediately upgrade to patched Apache Tomcat versions 11.0.21, 10.1.54, or 9.0.117

[Affected Scope] Apache Tomcat deployments utilizing EncryptInterceptor with default configurations for cluster membership protection (11.0.0-M1 to 11.0.18, 10.0.0-M1 to 10.1.52, 9.0.13 to 9.0.115, 8.5.38 to 8.5.100, 7.0.100 to 7.0.109).

[Impact] Remote attackers can intercept encrypted cluster traffic and perform a padding oracle attack to decrypt sensitive session data or cluster control messages without knowing the encryption key.

[Mitigation] Upgrade to fixed versions (11.0.19, 10.1.53, or 9.0.116) immediately, or configure the EncryptInterceptor to use secure authenticated encryption (e.g., GCM mode).

[Affected Scope] Apache ActiveMQ Classic versions prior to 5.19.4, and 6.0.0 through 6.2.3

[Impact] An authenticated attacker can execute arbitrary system commands within the broker's JVM by loading a malicious remote Spring XML configuration via the Jolokia JMX-HTTP bridge

[Mitigation] Immediately upgrade Apache ActiveMQ to a patched version (5.19.4 or 6.2.3) and restrict Jolokia access policies

[Affected Scope] Apache Tomcat versions 11.0.0-M1 through 11.0.2, 10.1.0-M1 through 10.1.34, 9.0.0.M1 through 9.0.98, and EOL 8.5.0 through 8.5.100.

[Impact] Attackers can bypass path validation via internal dot path equivalence, allowing them to inject malicious content into sensitive files or trigger remote code execution (RCE) via session deserialization.

[Mitigation] Immediately upgrade to patched versions (11.0.3, 10.1.35, or 9.0.99) and ensure the Default Servlet's 'readonly' parameter is set to 'true'.

[Affected Scope] Apache OFBiz versions prior to 18.12.16

[Impact] Unauthenticated remote attackers can bypass authorization checks to access internal business logic and sensitive data directly, potentially leading to Remote Code Execution (RCE).

[Mitigation] Immediately upgrade Apache OFBiz to the official patched version 18.12.16 or higher.

[Affected Scope] Apache OFBiz versions up to and including 18.12.14

[Impact] Unauthenticated remote attackers can execute arbitrary screen rendering code and system commands by sending specially crafted HTTP requests

[Mitigation] Immediately upgrade Apache OFBiz to the latest stable version 18.12.15 or higher

[Affected Scope] Apache HTTP Server versions 2.4.59 and earlier, specifically environments utilizing mod_rewrite rules where substitutions in server context use backreferences or variables as the first segment.

[Impact] Attackers can map URLs to restricted filesystem locations, leading to unauthorized source code disclosure or arbitrary code execution (RCE).

[Mitigation] Immediately upgrade Apache HTTP Server to version 2.4.60 or later, and review/restrict unsafe RewriteRules.

[Affected Scope] PHP versions 8.1.x (before 8.1.29), 8.2.x (before 8.2.20), and 8.3.x (before 8.3.8) running on Windows with Apache and PHP-CGI configuration under specific system code pages

[Impact] Unauthenticated remote attackers can inject arbitrary command-line options into the PHP binary, leading to remote code execution (RCE) and source code disclosure

[Mitigation] Immediately upgrade to patched PHP versions (8.1.29, 8.2.20, 8.3.8 or later) or apply Apache Rewrite rules to block malicious query strings

[Affected Scope] Apache OFBiz versions prior to 18.12.13

[Impact] Unauthenticated remote attackers can bypass security filters via path traversal, access internal APIs, and execute arbitrary system commands (RCE) on the target server.

[Mitigation] Immediately upgrade Apache OFBiz to the official patched version 18.12.13 or later.

[Affected Scope] Apache HugeGraph-Server versions from 1.0.0 before 1.3.0 running on Java 8 & Java 11

[Impact] Unauthenticated remote attackers can bypass security controls and execute arbitrary system commands via the Gremlin query engine, leading to full system compromise

[Mitigation] Upgrade Apache HugeGraph-Server to version 1.3.0 or higher with Java 11, and ensure the Authentication system is enabled

[Affected Scope] Apache ActiveMQ brokers and client libraries utilizing the OpenWire protocol

[Impact] Unauthenticated remote attackers can execute arbitrary shell commands on the target system by manipulating serialized class types

[Mitigation] Immediately upgrade both brokers and clients to patched versions (5.15.16, 5.16.7, 5.17.6, or 5.18.3 and above)

[Affected Scope] All web servers, reverse proxies, load balancers, and CDN architectures that have the HTTP/2 protocol enabled

[Impact] Attackers can cause a complete Denial of Service (DoS) by rapidly opening and immediately canceling (via RST_STREAM) a massive volume of HTTP/2 streams, exhausting server CPU and memory resources

[Mitigation] Immediately apply official security patches for your web servers (Nginx, Apache, IIS, etc.) and proxy devices, or restrict HTTP/2 concurrent streams and enforce strict rate limiting

[Affected Scope] Apache RocketMQ versions 5.1.0 and below, and versions 4.9.5 and below

[Impact] Unauthenticated remote attackers can execute arbitrary system commands with the privileges of the RocketMQ process, leading to full system compromise

[Mitigation] Immediately upgrade to RocketMQ version 5.1.1 or above (for 5.x) or 4.9.6 or above (for 4.x)

[Affected Scope] Apache Superset installations up to and including version 2.0.1 that have not altered the default configured SECRET_KEY.

[Impact] Unauthorized attackers can forge session cookies to authenticate as administrators, leading to unauthorized resource access, database compromise, and potential Remote Code Execution (RCE).

[Mitigation] Immediately configure a unique, cryptographically strong, randomly generated SECRET_KEY in 'superset_config.py' or via environment variables.

[Affected Scope] Apache Spark versions 3.0.3 and earlier, 3.1.1 to 3.1.2, and 3.2.0 to 3.2.1

[Impact] Remote attackers can execute arbitrary OS shell commands with the privileges of the Spark process via crafted HTTP requests

[Mitigation] Immediately upgrade Apache Spark to versions 3.1.3, 3.2.2, 3.3.0 or later, or disable the spark.acls.enable configuration

[Affected Scope] Apache Log4j versions 2.0-beta9 to 2.15.0 (including 2.15.0 for Java 8 and 2.12.1 or below for Java 7)

[Impact] Attackers can exploit JNDI Lookup patterns via Thread Context Map (MDC) inputs in non-default configurations to achieve remote code execution (RCE) or information leakage

[Mitigation] Immediately upgrade Apache Log4j to version 2.16.0 (for Java 8+) or 2.12.2 (for Java 7+), which disables JNDI by default and removes message lookup support

[Affected Scope] Apache Flink versions 1.11.0, 1.11.1, and 1.11.2

[Impact] Unauthenticated remote attackers can read arbitrary files on the JobManager local filesystem via the REST interface

[Mitigation] Immediately upgrade to Apache Flink 1.11.3, 1.12.0, or later versions

[Affected Scope] Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 Update 11 and earlier, and ColdFusion 10 Update 22 and earlier.

[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges by sending crafted Action Message Format (AMF) payloads.

[Mitigation] Apply the official Adobe security updates (APSB17-14) immediately and restrict external access to AMF gateway endpoints.