BIT-APISIX-2026-94250 Apache APISIX: Batch response aggregation can exhaust worker memory

Allocation of resources without limits or throttling vulnerability in batch-requests plugin in Apache APISIX. An unauthenticated caller can drive a gateway worker into OOM via a route where the batch-requests plugin is used and the batch endpoint is publicly exposed. This issue affects Apache...

BIT-APISIX-2026-94220 Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth plugin

Cross-Site request forgery CSRF vulnerability in feishu-auth and dingtalk-auth plugins in Apache APISIX. An attacker who can get a user to click a crafted link may cause that user's browser session on a protected route to be established under the attacker's identity instead of their own. Any work...

BIT-APISIX-2026-94212 Apache APISIX: unauthenticated impersonation issue in saml-auth

Improper verification of cryptographic signature vulnerability in Apache APISIX. Any unauthenticated attacker could impersonate any user on every route protected by the saml-auth plugin under default configuration. This issue affects Apache APISIX: from 3.17.0 through 3.18.0. Users are recommende...

BIT-APISIX-2026-82806 Apache APISIX: cross-request permission pollution via static permission list mutation

Exposure of data element to wrong session vulnerability in Apache APISIX. This issue affects Apache APISIX: from 2.3.0 before 3.7.0. Under a supported authz-keycloak configuration, a request's authorization scope could persist into later requests on the same route, leading to unintended...

BIT-APISIX-2026-78242 Apache APISIX: data-mask may fail to redact request headers in logger output

Insertion of sensitive information into log file vulnerability in Apache APISIX. This vulnerability can cause the unmasked header value to be written to the log sink under a certain response structure. This issue affects Apache APISIX: 3.17.0. Users are recommended to upgrade to version 3.18.0,...

CVE-2026-108039 Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limits

By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document. A very large request could therefore use a lot of memory and CPU during parsing, especially where CXF builds a DOM from the input for example SAAJ or WS-Security, and could...

CVE-2026-108039 Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limits

By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document. A very large request could therefore use a lot of memory and CPU during parsing, especially where CXF builds a DOM from the input for example SAAJ or WS-Security, and could...

CVE-2026-108039 Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limits

By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document. A very large request could therefore use a lot of memory and CPU during parsing, especially where CXF builds a DOM from the input for example SAAJ or WS-Security, and could...

CVE-2026-108039

The Apache CXF framework contains a vulnerability where StaxUtils fails to enforce limits on the total number of elements or characters in an XML document by default. This flaw allows an attacker to send an excessively large XML request, leading to excessive CPU and memory consumption during pars...

Security Bulletin: Vulnerabilities exists in IBM Netezza Appliance

Summary Vulnerabilities identified in IBM Netezza Appliance have been addressed in version 1.0.2.0 Vulnerability Details CVEID:CVE-2026-43869 DESCRIPTION: Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users a...

CVE-2026-107938

In Apache CXF, the Netty-based HTTP client transport cxf-rt-transports-http-netty-client did not verify that the hostname in the server’s TLS certificate matched the host being called. This applied over both HTTP/1.1 and HTTP/2, even when disableCNCheck was left at its default value of false. The...

CVE-2026-107938 Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification.

In Apache CXF, the Netty-based HTTP client transport cxf-rt-transports-http-netty-client did not verify that the hostname in the server’s TLS certificate matched the host being called. This applied over both HTTP/1.1 and HTTP/2, even when disableCNCheck was left at its default value of false. The...

CVE-2026-107938

The Apache CXF Netty-based HTTP client transport (cxf-rt-transports-http-netty-client ) fails to verify that the hostname in a server's TLS certificate matches the host being called. This flaw impacts both HTTP/1.1 and HTTP/2 protocols, even when the disableCNCheck parameter is set to its default...

EUVD-2026-95703

In Apache CXF, the Netty-based HTTP client transport cxf-rt-transports-http-netty-client did not verify that the hostname in the server’s TLS certificate matched the host being called. This applied over both HTTP/1.1 and HTTP/2, even when disableCNCheck was left at its default value of false. The...

org.apache.cxf.systests:cxf-systests-transport-netty (>=3.5.7, <=3.6.3), org.apache.cxf:apache-cxf (>=3.0.0, <=3.6.12) +1 more potentially affected by CVE-2026-107938 via org.apache.cxf:cxf-rt-transports-http-netty-client (>=3.0.0, <=3.6.12)

org.apache.cxf:cxf-rt-transports-http-netty-client MAVEN version =3.0.0, =3.5.7, =3.0.0, =3.0.0, =3.6.12 Source cves: CVE-2026-107938 Source advisory: MEND:CVE-2026-107938...

org.apache.cxf:apache-cxf (>=4.2.0, <=4.2.3), org.apache.cxf:cxf-distribution-manifest (>=4.2.0, <=4.2.3) potentially affected by CVE-2026-107938 via org.apache.cxf:cxf-rt-transports-http-netty-client (>=4.2.0, <=4.2.3)

org.apache.cxf:cxf-rt-transports-http-netty-client MAVEN version =4.2.0, =4.2.0, =4.2.0, =4.2.3 Source cves: CVE-2026-107938 Source advisory: MEND:CVE-2026-107938...

CVE-2026-107938 Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification.

In Apache CXF, the Netty-based HTTP client transport cxf-rt-transports-http-netty-client did not verify that the hostname in the server’s TLS certificate matched the host being called. This applied over both HTTP/1.1 and HTTP/2, even when disableCNCheck was left at its default value of false. The...

CVE-2026-107938 Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification.

In Apache CXF, the Netty-based HTTP client transport cxf-rt-transports-http-netty-client did not verify that the hostname in the server’s TLS certificate matched the host being called. This applied over both HTTP/1.1 and HTTP/2, even when disableCNCheck was left at its default value of false. The...

CVE-2026-107937

In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max-header-size default 300 characters and attachment-headers-max-count default 500 limits. The size limit was applied only to each physical line, not to a header value built from...

CVE-2026-107937 Apache CXF: The attachment header size and count limits can be bypassed, which allows denial of service through memory exhaustion.

In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max-header-size default 300 characters and attachment-headers-max-count default 500 limits. The size limit was applied only to each physical line, not to a header value built from...