CVE-2022-39135

CVE-2022-39135 (Apache Calcite XXE) is triggered by processing XML with SQL operators EXISTS_NODE, EXTRACT_XML, XML_TRANSFORM, and EXTRACT_VALUE in Calcite 1.22.0, allowing potential XML External Entity (XXE) abuse (e.g., file read, DoS, SSRF). From the connected IBM QRadar bulletin, this vulnera...

CVE-2020-13955

CVE-2020-13955 affects Apache Calcite: HttpUtils#getURLConnection disables hostname verification for HTTPS, enabling potential MITM attacks and information leakage when Calcite adapters connect to Druid or Splunk. The issue originates from a utility method that can be used to create vulnerable HT...

CVE-2026-46718

Apache Calcite is affected by CVE-2026-46718: Unsafe Reflection via a user-controlled model can load arbitrary classes, enabling code execution. Affected: 1.5.0 up to