CVE-2026-86463: Uncontrolled Resource Consumption

Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions. The search pattern can get stuck trying many combinations when it encounters a long string without an operator, causing the parser to consume excessive CPU time. An attacker can send a crafte...

PT-2026-109172

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift go bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

PT-2026-109182

Allocation of resources without limits or throttling, Integer overflow or wraparound, Heap-based buffer overflow vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

PT-2026-108893

Improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Apache Camel Karavan. A project file name supplied through the project file API was used verbatim as a path segment when the project was written to the working copy for a Git commit, so a name containing...

PT-2026-108815

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.4 Apache CXF versions prior to 4.1.9 Apache CXF versions prior to 3.6.13 Description Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider allows a...

PT-2026-108810

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.4 Apache CXF versions prior to 4.1.9 Apache CXF versions prior to 3.6.13 Description Improper verification of cryptographic signatures in the JAX-RS XML Security module allows for XML Signature wrapping. The...

Apache JMeter 3.3 RMI Deserialization Remote Code Execution

Apache JMeter version 3.3 running in distributed server mode permits unauthenticated deserialization through its RMI registry. This proof of concept provides a Docker-based vulnerable environment and a ysoserial BeanShell1 exploitation example. https://packetstorm.news/download/235004...

Apache Flink 1.11.2 JobManager Directory Traversal

Apache Flink version 1.11.2 contains a directory traversal vulnerability in the JobManager REST interface that allows attackers to read files accessible to the JobManager process. A proof of concept is included. https://packetstorm.news/download/235016...

PT-2026-109122

Insertion of sensitive information into log file vulnerability in Apache APISIX. This vulnerability can cause the unmasked header value to be written to the log sink under a certain response structure. This issue affects Apache APISIX: 3.17.0. Users are recommended to upgrade to version 3.18.0,...

PT-2026-109176

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Delphi bindings buffered transport. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

PT-2026-109175

Access of Uninitialized Pointer vulnerability in Apache Thrift c glib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

Apache ActiveMQ 5.18.1 OpenWire Deserialization Remote Code Execution

Apache ActiveMQ versions prior to 5.18.2 contain an OpenWire deserialization vulnerability that permits remote class instantiation and command execution. This proof of concept demonstrates the issue against version 5.17.3. https://packetstorm.news/download/235031...

Apache HTTP Server 2.4.49 Path Traversal

Apache HTTP Server version 2.4.49 contains a path traversal flaw that can disclose files outside the document root and, with CGI enabled, allow command execution. This proof of concept provides a vulnerable container and reproduction commands. https://packetstorm.news/download/235010...

PT-2026-109170

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java TSaslNonblockingServer. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

PT-2026-109214

Uncontrolled Recursion vulnerability in Apache Thrift c glib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

PT-2026-109202

Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Dart bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

Apache Thrift Buffer Overflow DoS

The vulnerability of the Apache Thrift framework is related to reading data beyond the allowed buffer size. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

Apache Thrift Pathname Restriction Unauthorized Access

The vulnerability of the Apache Thrift framework is related to shortcomings in pathname limitation. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

Apache Tomcat Authentication Bypass

The vulnerability of the Apache Tomcat application server relates to bypassing the authentication process. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...

Apache Tomcat DoS

The vulnerability of the Apache Tomcat application server is related to a single-shift error. Exploiting this vulnerability can allow a malicious actor to cause service failures...