announce  

Messages by Thread

• CVE-2026-91999: Apache Sling XSS: Improper escaping in the XSS Webconsole plugin Joerg Hoh
• [SECURITY] CVE-2026-86248 Apache Tomcat - Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled Mark Thomas
• [SECURITY] CVE-2026-87022 Apache Tomcat - WebSocket message smuggling with per-message-deflate Mark Thomas
• [SECURITY] CVE-2026-76183 Apache Tomcat - Bypass of security constraints for WebSocket endpoints Mark Thomas
• [SECURITY] CVE-2026-73581 Apache Tomcat - OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore Mark Thomas
• [SECURITY] CVE-2026-86247 Apache Tomcat Native - Client certificate requirements can be down-graded Mark Thomas
• [SECURITY] CVE-2026-86246 Apache Tomcat Native - Insecure OpenSSL options enabled Mark Thomas
• [SECURITY] CVE-2026-86243 Apache Tomcat Native - DoS via TLS handshake Mark Thomas
• [SECURITY] CVE-2026-78437 Apache Tomcat - HTTP/2 DoS via malformed request Mark Thomas
• [SECURITY] CVE-2026-86350 Apache Tomcat - Regression in fix for CVE-2026-41293 can trigger request header mix-up Mark Thomas
• [SECURITY] CVE-2026-79677 Apache Tomcat - WebSocket DoS due to lost asynchronous write timeout Mark Thomas
• [SECURITY] CVE-2026-78383 Apache Tomcat - AJP DoS via missing request body Mark Thomas
• [SECURITY] CVE-2026-77762 Apache Tomcat - Stale HPACK emitter injects trailers into recycled pooled Request Mark Thomas
• [SECURITY] CVE-2026-75973 Apache Tomcat - Cross-context authentication mix-up with Jakarta Authentication configured Mark Thomas
• [SECURITY] CVE-2026-77791 Apache Tomcat - DoS via busy wait during WebSocket close Mark Thomas
• [SECURITY] CVE-2026-77756 Apache Tomcat - Transfer-Encoding honored for HTTP/1.0 requests Mark Thomas
• CVE-2026-96443: Apache Doris: JDBC driver URL validation bypass leads to remote code execution Calvin Kirs
• CVE-2026-31377: Apache Doris: Improper Authentication Allows Unauthorized Access to FE Meta Service Calvin Kirs
• CVE-2026-92001: Apache Sling XSS: Missing parser resource limits Joerg Hoh
• CVE-2026-94243: Apache Sling Security Bundle: RefererFilter accepts weaker-than-origin evidence Joerg Hoh
• CVE-2026-94251: Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resource Joerg Hoh
• CVE-2026-91928: Apache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf protection mechanisms Joerg Hoh
• CVE-2026-91852: Apache Sling XSS: CWE-79 multiple raw-string break-outs and ReDOS in XSSImpl Joerg Hoh
• CVE-2026-73192: Apache Sling XSS: XSS possible through XSSAPI.getValidHref() Joerg Hoh
• CVE-2026-82331: Apache BuildStream: tar source extraction escape Jürg Billeter
• CVE-2026-70410: Apache Calcite Avatica: Unrestricted class initialization when instantiating plugins Stamatis Zampetakis
• [ANNOUNCE] OpenDAL 0.59.3-rc.1 released xuanwo
• [ANNOUNCE] Apache Groovy 5.1.3 Released Paul King
• CVE-2026-47321: Apache MINA: Unbounded Decompression Amplification DoS in Zlib.inflate Emmanuel Lécharny
• CVE-2026-75158: Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter Rahul Vats
• CVE-2026-82355: Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation Rahul Vats
• CVE-2026-86473: Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry Rahul Vats
• CVE-2026-94301: Apache MINA: CVE-2026-47065 resolveProxyClass fix missing from 2.0.X and 2.1.X branches (2.0.30 / 2.1.14) ZDRES-232 Emmanuel Lécharny
• [ANNOUNCE] Apache Fory 1.7.4 released Shawn Yang
• [ANNOUNCE] Apache Calcite Avatica 1.29.0 Released Francis Chuang
• CVE-2026-91864: Apache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustion Colm O hEigeartaigh
• CVE-2026-91865: Apache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of service Colm O hEigeartaigh
• CVE-2026-91866: Apache Neethi: Crafted policies cause unbounded work during intersection leading to denial of service Colm O hEigeartaigh
• CVE-2026-91867: Apache Neethi: Remote policy fetch lacks a total timeout, allowing a slow server to hang the request indefinitely Colm O hEigeartaigh
• CVE-2026-91863: Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of service Colm O hEigeartaigh
• CVE-2026-75157: Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression) Rahul Vats
• [ANNOUNCE] Apache Groovy 6.0.0-RC-3 Released Paul King
• https://karaf.apache.org/security/cve-2026-92230.txt: CVE-2026-92230: Apache Karaf: Improper release of ClassLoader references via static ThreadLocal caching Jean-Baptiste Onofré
• [ANNOUNCE] Apache Airflow 3.3.2 Released Rahul Vats
• [ANNOUNCE] Apache Camel 4.22.1 (LTS) Released Gregor Zurowski
• [ANNOUNCE] Apache Pulsar 5.0.0-M2 released Lari Hotari
• CVE-2026-77147: Apache Syncope: Groovy Sandbox escape for empty CommandArgs Francesco Chicchiriccò
• CVE-2026-86089: Apache NiFi: Missing Process Group Authorization for Connector Migration David Handermann
• CVE-2026-76646: Apache MyFaces: Denial of Service via Unbounded Request Parsing Volodymyr Siedlecki
• CVE-2026-68536: Apache MyFaces: Server-Side Request Forgery / Local File Inclusion Vulnerability Volodymyr Siedlecki
• CVE-2026-82561: Apache NiFi: Missing Authorization for Components Referenced in Flow Update Methods David Handermann
• CVE-2026-81866: Apache NiFi: Missing Authorization for Assets and Secrets Referenced by Connector Configuration David Handermann
• CVE-2026-87976: Apache NiFi Registry: Improper Limitation of Pathname in Persisted Extension Bundles David Handermann
• CVE-2026-70469: Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests David Handermann
• [ANNOUNCE] Apache Fory 1.7.3 released Shawn Yang
• [ANNOUNCE] Apache BookKeeper 4.18.1 released Matteo Merli
• [ANN] Apache Tomcat 9.0.122 available Rémy Maucherat
• CVE-2026-82311: Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is always false Vincent Beck
• CVE-2026-86465: Apache Airflow Akeyless provider: Akeyless secrets backend: team-scope guard bypass via user-controlled key Vincent Beck
• CVE-2026-82310: Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT access Vincent Beck
• CVE-2026-86466: Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validated Vincent Beck
• CVE-2026-76187: Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT Vincent Beck
• CVE-2026-76186: Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity Vincent Beck
• CVE-2026-86792: Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configuration Vincent Beck
• CVE-2026-86462: Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions Vincent Beck
• CVE-2026-84439: Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources Andor Molnar
• CVE-2026-79993: Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode Andor Molnar
• CVE-2026-84501: Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider Andor Molnar
• CVE-2026-59739: Apache ZooKeeper: Information disclosure via SetWatches reconnect replay Andor Molnar
• CVE-2026-59969: Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode Andor Molnar
• [ANN] Apache Tomcat 11.0.26 Available Mark Thomas
• [ANN] Apache Tomcat 10.1.60 Available Christopher Schultz
• [ANNOUNCE] OpenDAL 0.59.2-rc.2 released xuanwo
• CVE-2026-73191: Apache Syncope: CAS service URL injection via Forwarded HTTP headers Francesco Chicchiriccò
• [ANNOUNCE] Apache Airflow Providers prepared on 2026-09-09 are released Vincent Beck
• CVE-2026-87785: Apache Syncope: JWT subject spoofing Francesco Chicchiriccò
• CVE-2026-82232: Apache Syncope: SQL injection via sort parameter in Task search Francesco Chicchiriccò
• CVE-2026-75030: Apache Syncope: Incomplete authorization checks for Group members deprovisioning Francesco Chicchiriccò
• CVE-2026-77883: Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylist Francesco Chicchiriccò
• CVE-2026-77181: Apache Syncope: ClientApp update entitlement not effective Francesco Chicchiriccò
• CVE-2026-78318: Apache Syncope: Unauthenticated reflected XSS in Console and Enduser Francesco Chicchiriccò
• CVE-2026-87779: Apache Syncope: AES Secret Key disclosure via log output Francesco Chicchiriccò
• CVE-2026-68570: Apache Doris: Authorization bypass leading to unauthorized data access Calvin Kirs
• CVE-2026-72524: Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitrary tables Calvin Kirs
• CVE-2026-78330: Apache Syncope: Privilege escalation for admin user via JWT authentication Francesco Chicchiriccò
• CVE-2026-78336: Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user Francesco Chicchiriccò
• CVE-2026-86460: Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence Francesco Chicchiriccò
• CVE-2026-87802: Apache Syncope: SRA OAuth2 JWT signature verification bypass Francesco Chicchiriccò
• [ANN] Apache Syncope 4.1.3 Francesco Chicchiriccò
• [ANN] Apache Syncope 4.0.8 Francesco Chicchiriccò
• CVE-2026-73195: Apache Syncope: CSV export spreadsheet formula injection Francesco Chicchiriccò
• CVE-2026-73370: Apache Syncope: Cross-Realm boundaries reconciliation bypass Francesco Chicchiriccò
• CVE-2026-73236: Apache Syncope: Cross-Realm authorization bypass in delegated administration Francesco Chicchiriccò
• CVE-2026-73178: Apache Syncope: JWT Access Token takeover Francesco Chicchiriccò
• CVE-2026-73470: Apache Syncope: Delegating users can grant unowned Roles Francesco Chicchiriccò
• CVE-2026-73668: Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration values Francesco Chicchiriccò
• CVE-2026-73579: Apache Syncope: Non-recursive Any search could skip Realms restrictions Francesco Chicchiriccò
• CVE-2026-77051: Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search Francesco Chicchiriccò
• CVE-2026-75015: Apache Syncope: Nested secrets leak cleartext into audit records readable Francesco Chicchiriccò
• [ANNOUNCE] Apache Camel Karaf 4.18.4 has been released! Jean-Baptiste Onofré
• [ANNOUNCE] Apache IoTDB 2.0.11 released Haonan Hou
• [ANNOUNCE] Apache Groovy 6.0.0-RC-2 Released Paul King
• CVE-2026-82432: Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration Overrides Richard Zowalla
• CVE-2026-82428: Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys Richard Zowalla
• CVE-2026-82427: Apache Storm Nimbus: Path Traversal as the Supervisor User via Unsanitised Blobstore Map Local Name Richard Zowalla
• CVE-2026-82431: Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users Richard Zowalla
• CVE-2026-82437: Apache Storm Logviewer: Log Access Controls Not Enforced by Logviewer Richard Zowalla
• CVE-2026-82433: Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Daemon Configuration via Nimbus and the UI Richard Zowalla
• CVE-2026-82435: Apache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging Decoder Richard Zowalla
• CVE-2026-82429: Apache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker Launcher Richard Zowalla
• CVE-2026-82426: Apache Storm Nimbus: Arbitrary File Read on Nimbus via Unvalidated Uploaded Jar Location Richard Zowalla
• CVE-2026-82430: Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the Tenant Richard Zowalla
• CVE-2026-82434: Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs Richard Zowalla
• CVE-2026-82439: Apache Storm DRPC: Unauthenticated Unbounded Memory Growth in DRPC Richard Zowalla
• CVE-2026-82438: Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins Richard Zowalla
• CVE-2026-82441: Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys Richard Zowalla
• CVE-2026-84179: Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology Page Richard Zowalla
• [ANNOUNCE] Apache Storm 3.1.0 released Rui Abreu
• [ANNOUNCE] OpenNLP 2.5.12 and 3.0.0-M6 released Richard Zowalla
• CVE-2026-82617: Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patterns Richard Zowalla
• CVE-2026-67211: Apache OpenNLP: OOM DoS via Unbounded Array Allocation in SymSpellModelSerializer Richard Zowalla
• [ANNOUNCE] Apache Fory 1.7.2 released Shawn Yang
• CVE-2026-80354: Apache Camel K: Camel K Builder trait mavenProfiles ValueSources resolve tenant-named secrets in operator namespace Pasquale Congiusti
• CVE-2026-80352: Apache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary objects Pasquale Congiusti
• CVE-2026-80351: Apache Camel K: Camel K Tenant repositories reach Maven execution inside operator pod Pasquale Congiusti
• [ANNOUNCE] Apache Commons BCEL Version 6.13.0 Gary Gregory
• CVE-2026-49362: Apache Artemis, Apache ActiveMQ Artemis: Missing Authentication in CORE Protocol Handler Allows Unauthorized Queue Creation Clebert Suconic
• CVE-2026-57967: Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment Clebert Suconic
• CVE-2026-67593: Apache Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletion Clebert Suconic
• CVE-2026-49364: Apache Artemis, Apache ActiveMQ Artemis: Pre-Authentication Cluster Credential Exposure to Discovered Peers Clebert Suconic
• CVE-2026-49363: Apache Artemis, Apache ActiveMQ Artemis: Pre-Authentication Information Disclosure in CORE Protocol Topology Subscription Clebert Suconic
• CVE-2026-57822: Apache Artemis, Apache ActiveMQ Artemis: Message-based management parameter deserialization may lead to denial of service Clebert Suconic
• CVE-2026-75880: Apache Artemis, Apache ActiveMQ Artemis: Message selector wildcard handling could lead to denial of service Clebert Suconic
• [ANNOUNCE] Release Apache DolphinScheduler 3.4.3 wenjun
• CVE-2026-54048: Apache Impala: Avro Schema URL Server-Side Request Forgery Michael Smith
• CVE-2026-57866: Apache Impala: Secrets Exfiltration via SSRF Michael Smith
• CVE-2026-56207: Apache Impala: SAML authentication bypass via forged bearer token Michael Smith
• CVE-2026-65181: Apache Impala: RCE via External Data Source Class Loading Michael Smith
• [ANNOUNCE] Apache Impala 4.5.2 release Michael Smith
• [ANNOUNCE] Apache Arrow Go v18.8.0 Released Matt Topol
• CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass Niko Oliveira
• CVE-2026-74761: Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId Matt Pavlovich
• CVE-2026-41871: Apache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API) Sebastian Nagel
• CVE-2026-41870: Apache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API) Sebastian Nagel
• CVE-2026-41869: Apache Nutch: Unauthenticated forced shutdown and job interruption in Nutch Server (Nutch REST API) Sebastian Nagel
• [ANNOUNCE] Apache Nutch 1.23 Release Sebastian Nagel
• CVE-2026-84939: Apache FreeMarker: A malformed locale may be exploitable for path traversal attacks Dániel Dékány
• [ANN] Apache Tomcat Native 1.3.9 released Mark Thomas
• [ANN] Apache Tomcat Native 2.0.16 released Mark Thomas
• [ANNOUNCE] Apache Groovy 6.0.0-RC-1 Released Paul King
• [ANNOUNCE] Apache PLC4X 1.0.0 released Christofer Dutz
• [ANNOUNCE] Apache Groovy 5.1.2 Released Paul King
• CVE-2026-78254: Apache Ant: Path traversal in ftp and scp tasks allows arbitrary file write Stefan Bodewig
• [ANN] Apache Ant 1.10.18 Released Stefan Bodewig
• [ANNOUNCE] Apache Commons Secure XML 1.0.0 Gary Gregory
• CVE-2026-52691: Apache Griffin Hive Metastore Module: SQL Injection Vulnerability in Hive Metastore Module Arnout Engelen
• [ANNOUNCE] Apache Fory 1.7.1 released Shawn Yang
• [ANNOUNCE] Release Apache OpenDAL 0.59.0 Xuanwo
• CVE-2026-71216: Apache SkyWalking: PagerDuty alarm hook transmits the integration routing key over cleartext HTTP Kai Wan
• CVE-2026-85229: Apache SkyWalking: CWE-79 stored XSS in Booster UI dashboard widgets (incomplete fix of CVE-2025-54057) Sheng Wu
• CVE-2026-80180: Apache Allura: Stored XSS via markdown HTML processing Dave Brondsema
• CVE-2026-80181: Apache Allura: Server-side request forgery Dave Brondsema
• CVE-2026-81270: Apache Allura: Information exposure via search Dave Brondsema
• CVE-2026-80190: Apache Allura: Stored XSS via code repositories Dave Brondsema
• [ANNOUNCE] Apache Allura 1.21.0 released Dave Brondsema
• [ANNOUNCE] Apache ActiveMQ v6.3.2 has been released! Matt Pavlovich
• [ANNOUNCE] Apache CloudStack Regular Release 4.23.0.0 Wei Zhou
• Apache Beam 2.76.0 Released! Vitalii Terentev
• CVE-2026-32773: Apache Spark: XSS Vulnerability in Spark Web 3.5.4 Holden Karau
• [ANNOUNCE] Apache NetBeans 31 Released Eric Barboni
• [ANNOUNCE] Apache Fory 1.7.0 released Shawn Yang
• CVE-2026-76983: Apache Wicket: XSS in AutoLabelTextResolver via FormComponent.setLabel Emond Papegaaij
• CVE-2026-76985: Apache Wicket: XSS in Palette via getAdditionalAttributes Emond Papegaaij
• CVE-2026-76986: Apache Wicket: XSS in AbstractSingleSelectChoice via getNullValidDisplayValue Emond Papegaaij
• CVE-2026-76984: Apache Wicket: XSS in MetaDataHeaderItem via addTagAttribute Emond Papegaaij
• CVE-2026-76982: Apache Wicket: XSS in Button via its model object Emond Papegaaij
• CVE-2026-75802: Apache Wicket: XSS in AjaxEditableLabel and its subclasses via IChoiceRenderer and defaultNullLabel Emond Papegaaij
• CVE-2026-58301: Apache Shiro: Server-side POST request may be steered to an alternate host Lenny Primak
• CVE-2026-71257: Apache Wicket: Configured file upload limits are not enforced when the multipart request has already been parsed Emond Papegaaij
• CVE-2026-71378: Apache Wicket: Cross-Site Request Forgery (CSRF) protection bypass in ResourceIsolationRequestCycleListener Emond Papegaaij
• CVE-2026-70449: Apache Wicket: Path traversal in resource style/variation/locale Emond Papegaaij
• [ANNOUNCE] Apache Wicket 10.11.0 released Andrea Del Bene
• [ANNOUNCE] Apache Wicket 9.24.0 released Andrea Del Bene
• [ANNOUNCE] Apache Wicket 8.19.0 released Andrea Del Bene
• [ANNOUNCE] Apache Airflow Providers prepared on 2026-08-25 are released Niko Oliveira
• [ANNOUNCE] Apache Grails 8.0.0-M6 Mattias Reichel
• [ANNOUNCE] Apache Burr (Incubating) 0.43.0 released Jernej Frank
• [ANNOUNCE] Apache FreeMarker 2.3.35 is released Daniel Dekany
• [ANNOUNCE] Apache SkyWalking 11.0.0 released Kai Wan
• [ANNOUNCEMENT] Apache SkyWalking BanyanDB 0.11.0 Released hanahmily
• [ANNOUNCE] Apache Ozone 2.2.1 released Wei-Chiu Chuang
• [ANNOUNCE] Apache Shiro 3.0.1 released Lenny Primak
  • Re: [ANNOUNCE] Apache Shiro 3.0.1 released Lenny Primak
• [ANNOUNCE] Apache Artemis 2.56.0 Released Domenico Francesco Bruscino
• [ANNOUNCE] Apache Groovy 6.0.0-beta-3 Released Paul King
• [ANNOUNCE] Apache Groovy 5.1.1 Released Paul King
• [ANNOUNCE] Apache Grails 7.2.3 James Daugherty
• [ANNOUNCE] Apache Grails 7.1.6 James Daugherty
• [ANNOUNCE] Apache Grails 7.0.16 James Daugherty
• [ANNOUNCE] Apache XTable 0.4.0-incubating released Vinish Reddy

• Earlier messages