Apache Tomcat Synchronization Data Compromise

The vulnerability of the Apache Tomcat application server is related to synchronization errors when using a shared resource. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

Apache Thrift Integer Overflow DoS

The vulnerability of the Apache Thrift framework is related to integer overflow. Exploiting this vulnerability can allow a malicious actor to cause service failures...

Apache Thrift Buffer Overflow DoS

The vulnerability of the Apache Thrift framework is related to reading data beyond the allowed buffer size. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

Apache Thrift Uncontrolled Recursion

The vulnerability of the Apache Thrift framework is related to uncontrolled recursion. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

Apache Tomcat Data Compromise

The vulnerability of the Apache Tomcat application server is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information...

Apache Tomcat Authentication Bypass

The vulnerability of the Apache Tomcat application server is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to compromise the integrity and accessibility of protected information...

Apache Tomcat Authentication Bypass

The vulnerability of the Apache Tomcat application server is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and integrity of the protected information...

Apache Tomcat Resource Consumption DoS

The vulnerability of the Apache Tomcat application server is related to an uncontrolled consumption of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures...

Apache Thrift Host Certificate Unauthorized Access

The vulnerability of the Apache Thrift framework is related to the lack of checks for host-specific certificate data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

Apache Tomcat Authentication Bypass

The vulnerability of the Apache Tomcat application server relates to bypassing the authentication process. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...

Apache Tomcat Access Control Bypass

The vulnerability of the Apache Tomcat application server is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to bypass security restrictions remotely...

Apache Tomcat FORM Authentication

The vulnerability of the FORM authentication process on Apache Tomcat servers is related to deficiencies in the authorization mechanism. Exploiting this vulnerability allows a malicious actor to bypass security restrictions remotely...

PT-2026-108893

Improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Apache Camel Karavan. A project file name supplied through the project file API was used verbatim as a path segment when the project was written to the working copy for a Git commit, so a name containing...

PT-2026-108810

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.4 Apache CXF versions prior to 4.1.9 Apache CXF versions prior to 3.6.13 Description Improper verification of cryptographic signatures in the JAX-RS XML Security module allows for XML Signature wrapping. The...

PT-2026-109198

Improper validation of specified quantity in input, Allocation of resources without limits or throttling, Excessive Iteration vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-97468: Use of Weak Hash

Apache CXF's STSTokenValidator and Security Token Service STS cached validated security tokens under a non-cryptographic 32-bit hash of the token Java Arrays.hashCode/hashCode, and treated a cache hit as proof that the presented token had already been validated. An attacker could craft a token fo...

PT-2026-109183

Uncontrolled Recursion vulnerability in Apache Thrift go bindings. Both Go transports satisfy a read out of a buffered frame and, when that frame yields no payload bytes, read the next frame and call Read again instead of looping. A peer produces such a frame for 4 bytes in TFramedTransport...

CVE-2026-100227: Concurrent Execution using Shared Resource with Improper Synchronization

Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module. The JAX-RS XML Signature interceptors XmlSigInHandler, XmlSigInInterceptor and the streaming XmlSecInInterceptor did not ensure that the XML passed to the application was covered by the...

CVE-2026-86463: Uncontrolled Resource Consumption

Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions. The search pattern can get stuck trying many combinations when it encounters a long string without an operator, causing the parser to consume excessive CPU time. An attacker can send a crafte...

PT-2026-108816

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.4 Apache CXF versions prior to 4.1.9 Apache CXF versions prior to 3.6.13 Description The CompressionUtils.inflate function decompresses attacker-controlled DEFLATE data without an output-size cap, allowing a...