Apache
Monthly
Sensitive-information exposure in Apache Kylin versions 4 through 5.0.4 permits an authenticated user to obtain data they are not authorized to see, with confidentiality impact rated High while integrity and availability are unaffected. The Apache Kylin project addressed the flaw in version 5.0.5; because the upstream advisory names neither the specific endpoint, feature, nor configuration that triggers the disclosure, the exact attack path must be confirmed against the advisory thread. Risk signals are currently sparse - no CVSS vector or score was supplied with the CVE, no EPSS probability, no CISA KEV listing, and no public exploit code are present in the available data, so this cannot be ranked as a confirmed priority, and no public exploit has been identified at time of analysis.
Unauthenticated SQL injection in Apache Kylin 5.0.0 through 5.0.4 allows a remote attacker who can reach a specific backend cache API endpoint to bypass the missing authentication check and reach SQL-executing logic, with the injected statement executed by the Kylin service (assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L). Per Apache's advisory, practical exposure is concentrated on Kylin instances directly reachable from the public internet - the vendor characterizes this as uncommon - while in-house deployments confined to trusted internal networks are mostly not impacted, so the operative precondition is network reachability of the service rather than any configuration toggle. No CVSS vector from the vendor, EPSS score, KEV listing, or public exploit code was provided in the available intelligence, so no public exploit has been identified at time of analysis and quantitative exploitation signals are absent; severity rests on the vulnerability class and the vendor's own scoping. A fixed release exists in Apache Kylin 5.0.5.
Unauthenticated exposure of system-level configuration information in Apache Kylin 4.0.0 through 5.0.4 lets any client that can reach the Kylin service retrieve sensitive deployment details, rated CVSS 3.1 base 7.5 (HIGH) with high confidentiality impact but no integrity or availability effect. Per the assessed vector (AV:N/AC:L/PR:N/UI:N), no authentication, user interaction, or non-default configuration is required, so default-reachable instances are exposed; exposure is limited mainly by whether the instance is network-reachable, and deployments confined to internal networks or placed behind authenticating proxies are significantly less at risk. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied, so prioritization should be driven by network exposure of Kylin installations rather than by observed exploitation. Upgrading to 5.0.5 is the vendor-recommended fix.
Remote code execution via arbitrary file upload affects the YaySMTP WordPress plugin in all versions up to and including 2.7.7, where an authenticated subscriber-level user can upload executable files through the putFile function. The plugin relies on sanitize_file_name() without an allow-list, MIME check, or safe-extension rename, and its only server-side guard is a .htaccess file with 'Require all denied' that nginx and Apache with AllowOverride None ignore, so full RCE is achievable on those configurations. No public exploit code was identified at time of analysis and there is no confirmed CISA KEV active exploitation; exploitation requires authentication at subscriber level or above, which is commonly available when open user registration is enabled.
Apache Answer through 2.0.2 fails to enforce content visibility in its reaction API, letting any remote, unauthenticated client read reaction metadata attached to visibility-restricted (private or limited-audience) posts and comments and add or remove its own reactions against content it is not authorized to see. Impact is bounded - reaction metadata and the attacker's own reaction state are exposed, not the restricted content body - and the vendor rates the issue moderate; there is no server-side availability or broader integrity impact. Apache Answer 2.0.3 fixes the issue; no public exploit identified at time of analysis, and exploitation only matters on deployments that combine visibility-restricted content with the reaction feature.
Missing authorization checks in Apache Answer through 2.0.2 let an authenticated user perform mutations on non-public content they are not permitted to access, producing limited confidentiality and integrity impact on the affected instance rather than account or host takeover. Assessed severity is moderate (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) and the flaw requires a valid account, making instances that allow open or self-service registration the most exposed. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV); upgrading to Apache Answer 2.0.3 is the fix.
Improper authorization in Apache Answer 2.0.2 and earlier allows holders of a valid global API key to retrieve answer content tied to questions that are hidden, deleted, or still pending review. The defect is in the MCP (Model Context Protocol) answer-retrieval tool, which returns content without honoring the per-question visibility state, so an authenticated key holder - an insider, a third-party integration, or anyone using a leaked key - can read material the Q&A platform intended to withhold. It is not reachable by anonymous remote attackers, impact is limited to information disclosure with no modification or denial of service, and no public exploit identified at time of analysis; CISA KEV does not list this issue.
Apache Answer 2.0.2 and earlier records full API keys in plaintext in application logs on every authenticated request, so anyone able to read those logs - via local filesystem access, a shared or centralized logging pipeline, a backup, or a compromised logging account - can recover active bearer tokens and replay them against the platform. The prerequisite of log read access is the dominant limiting factor: this is not exploitable against the public interface by an unauthenticated internet attacker, and no public exploit code or active exploitation has been identified at time of analysis. It is a genuinely low-priority credential-disclosure issue whose real-world severity depends on how widely Answer's logs are distributed and how long tokens remain valid.
Resource exhaustion in Apache Kylin 4.0.0 through 5.0.4 lets an attacker who already holds project admin permission abuse a cache API to drive computed-column processing into unbounded resource allocation, degrading or denying availability of the Kylin service. The weakness is reachable only by authenticated users with high privileges (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L), so a compromised or malicious project administrator account is a prerequisite; there is no confidentiality or integrity impact and no public exploit identified at time of analysis. Severity is low, no CISA KEV entry or public exploit exists, and the vendor-released fix is Kylin 5.0.5 (tracked as KYLIN-6112).
Unauthenticated access to Apache Kylin's in-house broadcast API combined with polymorphic deserialization of attacker-supplied data exposes Kylin 4.0.0 through 5.0.4 to high-impact compromise of the affected service, assessed as network-reachable without privileges or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vendor classifies the issue as 'moderate' severity but notes that practical risk is concentrated on Kylin instances whose broadcast endpoint is directly reachable from a public network, which Apache describes as 'not common'; typical internal-only deployments are considered largely unimpacted. No CISA KEV entry, EPSS score, or public exploit code was present in the source data, so there is no public exploit identified at time of analysis, and this assessment rests almost entirely on the Apache advisory, which recommends upgrading to Apache Kylin 5.0.5.
Missing authorization on the JDBC source-configuration update function in Apache Kylin 4.0.0 through 5.0.4 allows an authenticated, low-privileged user to modify a project's data-source connection settings, producing a high integrity impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) with only limited confidentiality exposure and no availability impact. The vendor explicitly frames exposure as network-bounded: risk is concentrated on Kylin services directly reachable from the public network, described as uncommon, while in-house deployments behind network controls are mostly not impacted. No public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was supplied with the source data.
Unauthenticated metadata broadcast processing in Apache Kylin 4.0.4 through 5.0.4 allows remote attackers who can reach the affected broadcast/metadata-processing endpoint to bypass authentication and have limited impact on confidentiality and integrity of the service. Per the vendor's own advisory, the exposure is largely confined to the in-house (cluster/internal) network, so the realistic high-impact scenario requires the non-default and explicitly "not common" condition of a Kylin service being directly reachable from the public network; Kylin deployments upgraded to 5.0.5 or kept off the internet are the primary limiting factors. This is a moderate-severity issue (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, i.e. unauthenticated, no user interaction, low confidentiality and integrity impact) and there is no public exploit identified at time of analysis and no CISA KEV listing; the flaw is tracked upstream as KYLIN-6107.
Broken access control in Apache Kylin 4.0.0 through 5.0.4 allows a remote, unauthenticated actor to read the server's configured SQL blacklist through the QuerySQLBlacklistController endpoint (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). The exposed asset is limited to the blacklist configuration itself - no query data, credentials, or code execution - but the disclosure can reveal which query patterns are being blocked, which may help an attacker tailor queries that evade those governance controls. There is no public exploit code and no confirmed active exploitation (CISA KEV) at time of analysis; Apache has fixed the flaw in Kylin 5.0.5.
Unauthorized cross-project job manipulation in Apache Kylin 4.0.0 through 5.0.4 allows an authenticated user with a valid account in one project to operate on job records belonging to projects they are not a member of, because the JobController component does not enforce project-scoped authorization (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L). The vendor rates the issue 'important' but explicitly scopes real-world impact to Kylin services directly reachable from the public network, which it describes as uncommon; in-house, network-isolated deployments are largely unaffected. No publicly available exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was available; upgrading to Apache Kylin 5.0.5 removes the condition.
Apache Airflow's SSH and SFTP provider hooks accept any server host key by default, so an attacker positioned as a machine-in-the-middle between an Airflow worker and an SSH or SFTP endpoint can impersonate that server and capture task credentials or transferred data. All releases of apache-airflow-providers-ssh and apache-airflow-providers-sftp before 7.0.0 are affected when a connection has neither host_key configured nor no_host_key_check explicitly disabled; the assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, i.e. unauthenticated from the attacker's side but gated on the high-complexity MITM prerequisite, which is why the input's 9.1 rating overstates practical urgency. No public exploit code has been identified and EPSS is only 0.18% (7th percentile); vendor patches (provider 7.0.0) are released, and the related deferrable-SFTP path is tracked separately as CVE-2026-94135, which the same SFTP 7.0.0 release also fixes.
OAuth1 request replay in Apache Allura through 1.21.0 lets a remote, unauthenticated attacker reuse a previously captured OAuth1-signed request to act with the original requester's authorization, because the platform does not adequately enforce nonce/timestamp single-use. The practical barrier is high rather than trivial: the attacker must first obtain a genuine signed request from a legitimate user - most plausibly through network interception, a man-in-the-middle position, or access to logged or leaked requests - and the replay only yields the scope of that specific captured request rather than arbitrary access, which is why the attack-complexity is assessed as high (AC:H) despite the PR:N vector. No public exploit code and no confirmed active exploitation were identified at time of analysis; EPSS is low at roughly 0.15% (4th percentile), so mass scanning is unlikely, though the vendor has published a fix in Apache Allura 1.22.0.
Remote unauthenticated attackers can manipulate object attributes through the Apache Allura REST API in versions up to and including 1.21.0, because the API's object-binding logic (CWE-915, mass assignment) fails to whitelist which client-supplied fields may be written. The published CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, giving a base score of 9.1 with high confidentiality and integrity impact and no availability impact, and no user interaction or credentials are required per that vector, though the practical exposure is limited by the small, largely self-hosted population of Allura instances and whether the affected write endpoints are reachable or gated behind authentication in a given deployment. Exploitation does not appear to be widespread: EPSS is only 0.29% (20th percentile), there is no CISA KEV listing, and no public exploit code was identified at time of analysis; the vendor-released fix is Apache Allura 1.22.0.
Open redirect flaw in the OAuth1 callback validation of Apache Allura through 1.21.0 allows unauthenticated remote attackers to redirect users to arbitrary attacker-controlled URLs during the OAuth authorization flow (CWE-601), potentially exposing authorization codes or tokens if a victim completes the flow. Exploitation is not drive-by: per the independent assessment a user must be induced to traverse the attacker-influenced OAuth request (UI:R), which lowers real-world risk below the supplied 9.1 base score; the vendor patched the issue in Allura 1.22.0, no public exploit identified at time of analysis, and EPSS is 0.15% (4th percentile), so this is assessed as a moderate real-world priority.
Out-of-bounds read in Apache DataSketches C++ (datasketches-cpp) allows an attacker who controls a serialized VarOpt union image to trigger reads of up to 24 bytes past the end of the supplied buffer, causing a crash (denial of service) and potentially leaking adjacent heap memory into the deserialized union's state. Applications are exposed only if they call var_opt_union::deserialize() on data from untrusted sources; affected releases are 2.0.0-incubating through 5.2.0, and the library is not exploitable on its own. No public exploit code has been identified at time of analysis, EPSS is low at 0.24% (14th percentile), and the issue is not listed in CISA KEV, so the practical priority is moderate rather than urgent. The vendor-released fix is version 5.3.0, which also remediates four other deserialization flaws.
Out-of-bounds read in Apache DataSketches C++ versions 3.1.0 through 5.2.0 is reachable when an application deserializes a compact Theta sketch from an untrusted source, allowing unauthenticated remote attackers to crash the process (denial of service) and potentially disclose adjacent memory contents. The flaw sits in compact_theta_sketch::deserialize() and wrapped_compact_theta_sketch::wrap(), which parse header fields before verifying the input length; in the compressed format a 32-bit integer overflow defeats the length check and two decoding-controlling header fields go unvalidated, and the stream-based deserialization path is affected as well. Apache rates this issue low severity in its 5.3.0 release notes, no public exploit code has been identified at time of analysis, the vulnerability is not in CISA KEV, and EPSS is only 0.20% (9th percentile); exploitation requires the explicit, non-default precondition that the host application accept Theta sketch images from untrusted sources, so the practical priority is lower than the raw 9.1 CVSS might suggest.
Out-of-bounds read and write in the CPC sketch deserialization path of Apache DataSketches C++ (datasketches-cpp) - specifically cpc_sketch::deserialize() called on a byte buffer or a stream - allows a crafted serialized sketch to corrupt heap memory: the decompressor reads past the end of the compressed data because the read position was only checked after decoding finished, and in the hybrid flavor it writes outside an internal heap buffer because decoded row indices were not validated, crashing the process with potential for further exploitation. All releases from 2.0.0-incubating before 5.3.0 are affected, and the CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating remote, unauthenticated impact, but reachability is conditional: only applications that deserialize CPC sketches from untrusted sources are exposed, since the flaw lives in a C++ library whose attack surface depends on the embedding application. Exploitation signals are mixed and should be weighed carefully - EPSS is only 0.19% (8th percentile), there is no CISA KEV entry, and no public exploit identified at time of analysis.
Heap buffer overflow in Apache DataSketches C++ (versions 1.0.0-incubating through 5.2.0) allows an unauthenticated remote attacker who can supply a crafted HLL sketch for deserialization to write up to 988 bytes past a fixed 8-entry internal heap buffer, corrupting memory, crashing the process, and potentially enabling further exploitation. The vulnerable code is a library routine with no network listener of its own, so real-world exposure hinges on whether the consuming application deserializes sketch images from untrusted byte buffers or streams; services that only process trusted or internally generated sketches are not realistically exposed despite the AV:N vector. No public exploit code has been identified at time of analysis, and EPSS is low at 0.21% (11th percentile), while the assessed CVSS 3.1 base of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects the worst case for applications that do accept untrusted sketches, meaning the high score and low observed exploitation signal must be weighed together.
Code injection in the Fastcache by Host.it WordPress plugin (all versions up to and including 1.7.4) allows an authenticated administrator-level user to write arbitrary Apache directives into the site's .htaccess file, which can be escalated to full remote code execution by setting php_value auto_prepend_file to load attacker-controlled PHP on every request. Exploitation requires the PR:H vector from the assessed CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H score (7.2), i.e. a logged-in account with administrator privileges, and is further conditioned on the site running Apache with an .htaccess file the plugin can write and an AllowOverride configuration that honors php_value directives - on nginx or Apache with AllowOverride None the injected directives have no effect. No public exploit code was identified at time of analysis and the flaw is not listed in CISA KEV; this is a genuine but access-gated privilege-to-RCE escalation rather than a mass-exploitable perimeter bug.
Any authenticated user of Apache Camel Karavan 4.0.0 up to (but not including) 4.22.1 - regardless of role - can push arbitrary Kubernetes resources into the cluster through the deployment workflow. When a deployment is started, Karavan unmarshals the project's kubernetes.yaml and applies every resource it contains without restricting resource kinds, rejecting security-sensitive pod options (hostNetwork, hostPID, hostIPC, hostPath volumes, host ports, privileged containers, privilege escalation, added capabilities), or pinning a target namespace. The vendor score is 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), while the independent assessment scores it scope-changed (S:C) because successful exploitation escapes the Karavan namespace boundary; the practical blast radius is capped by the RBAC permissions granted to Karavan's Kubernetes service account. There is no CISA KEV listing and no public exploit code identified at time of analysis, and the issue is fixed in 4.22.1.
Path traversal in Apache Camel Karavan 3.18.0 through 4.22.0 allows an authenticated user of any role to write arbitrary files outside the project directory by supplying a project file name containing '../' sequences, leading to overwrite of application configuration or classpath files and potential remote code execution in the Karavan container. The flaw is present in default behavior and requires only a valid account (CVSS 8.8, PR:L). No public exploit code or active exploitation has been identified at time of analysis, but the high impact and low privilege requirement make this a genuine high-priority issue.
Apache CXF versions prior to 4.2.4, 4.1.9, and 3.6.13 allow remote, unauthenticated attackers to cause a denial of service by submitting a very large XML document that exhausts memory and CPU during parsing. The flaw lies in StaxUtils, which by default imposes no limit on the total number of elements or characters, and is most impactful when CXF builds a DOM from the input, such as in SAAJ or WS-Security processing. No public exploit code has been identified, and deployments that enforce a request size limit are largely protected.
Man-in-the-middle attackers can impersonate any TLS server contacted by Apache CXF's optional Netty-based HTTP client transport, because cxf-rt-transports-http-netty-client validates the server certificate chain against the configured trust store but never checks that the certificate's hostname matches the host actually being called - a gap present over both HTTP/1.1 and HTTP/2 and present even with disableCNCheck left at its secure default of false. Applications running Apache CXF before 3.6.13, 4.1.9 or 4.2.4 that use this transport for outbound TLS calls are affected; an unauthenticated attacker who already holds a traffic-interception position and any certificate issued by a CA in the client's trust store (for example, a free publicly issued certificate for an attacker-controlled domain) can read or modify exchanged messages and credentials. No public exploit identified at time of analysis, and exploitation is gated by the requirement for an on-path MITM position plus a trusted-chain certificate, which is reflected in our assessed vector returning High attack complexity rather than the published AC:L; EPSS is correspondingly low at 0.11% (1st percentile), so this is a serious TLS trust failure rather than an immediate mass-exploitation priority. Vendor fixes are available in 3.6.13, 4.1.9 and 4.2.4.
Unbounded memory allocation in Apache CXF's multipart/MTOM attachment part-header parser lets a remote, unauthenticated attacker exhaust server memory and cause a denial of service by sending a single crafted multipart request. The parser applies attachment-max-header-size (default 300 characters) only per physical line and enforces attachment-headers-max-count (default 500) against distinct header names rather than total header lines, so folded continuation lines or a repeated header name slip past both limits and inflate the parsed value without bound. Affected are CXF 4.2.0 through 4.2.3, 4.0.0 through 4.1.8, and all releases before 3.6.13 that expose a multipart/MTOM-accepting endpoint; fixed releases are 4.2.4, 4.1.9 and 3.6.13. Exploitation requires no authentication (CVSS PR:N/UI:N) and no non-default configuration, but it is limited to availability impact only; EPSS is low at 0.24% (14th percentile) and no public exploit code or confirmed active exploitation was identified at time of analysis.
XML signature wrapping in Apache CXF's JAX-RS XML Security module allows remote, unauthenticated attackers to have unsigned content accepted as if it were covered by a trusted XML signature. Only deployments that consume inbound XML through CXF's XML Signature interceptors (XmlSigInHandler, XmlSigInInterceptor, or the streaming XmlSecInInterceptor) are exposed, and the attacker must first hold any XML document signed by a key the target trusts; that signed document can then be wrapped in forged content and repeatedly presented. Fixed versions 4.2.4, 4.1.9, and 3.6.13 address the issue; no public exploit code has been identified and EPSS is low (0.17%, 6th percentile), though integrity impact is rated High (CVSS 7.5).
Trust bypass in Apache CXF's STSTokenValidator allows a remote, unauthenticated attacker to have a forged SAML assertion signed with an untrusted certificate accepted as trusted without the assertion ever being validated by the Security Token Service. Only deployments that use STSTokenValidator to validate SAML tokens while leaving alwaysValidateToSts unset are affected, and exploitation additionally requires a race window in which the result of a concurrent legitimate request's successful trust check is read from shared state. No public exploit code or CISA KEV listing has been identified at time of analysis, EPSS is 0.17% (6th percentile), and vendor fixes are available in Apache CXF 4.2.4, 4.1.9 and 3.6.13.
Token validation bypass in Apache CXF's STSTokenValidator and Security Token Service (STS) allows unauthenticated remote attackers to impersonate another user by presenting a forged UsernameToken or self-signed SAML Assertion whose 32-bit Java hash collides with an entry already held in the validated-token cache. Because a cache hit is treated as proof of prior validation, the forged token is accepted without password validation, signature trust verification, or any call to the STS, and can subsequently be exchanged through STS validation or renewal for STS-signed tokens issued for the victim identity. Exploitation is constrained in practice: the target deployment must use STSTokenValidator or STS token validation/renewal with the validated-token cache enabled, and a legitimately validated token for the identity being impersonated must already be present in that cache; no public exploit code has been identified at time of analysis, KEV status is negative, and EPSS is low (~0.17%, 6th percentile), yet the headline CVSS of 9.1 reflects high confidentiality and integrity impact if the preconditions are met. Vendor patches are available in 4.2.4, 4.1.9, and 3.6.13.
CPU exhaustion denial of service in Apache CXF's FIQL query parser allows remote attackers to degrade or stall a server by submitting a long search expression containing no recognizable operator, which drives the parser's operator-search logic into excessive combinatorial matching and burns CPU on a request-handling thread. Affected are CXF 3.6.x, 4.1.x and 4.2.x deployments that expose FIQL-based search/filter endpoints; the assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (base 7.5), meaning availability impact only, with confidentiality and integrity unaffected. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor-released fixes - 4.2.4, 4.1.9 and 3.6.13 - neutralize the long-input vector by capping FIQL expressions at 4 KiB by default while still permitting normal queries.
A remote, unauthenticated attacker can exhaust server heap memory in Apache CXF by submitting a small (kilobyte-scale) DEFLATE payload that inflates to gigabytes when the framework decompresses it without any output-size cap. The flaw is reachable through two deployment-specific paths: JWE decryption when the 'zip=DEF' compression header is present (for example a JoseSessionTokenProvider configured with RSA-OAEP key wrap), and SAML token inflation over the HTTP redirect or POST binding - in both cases decompression occurs before or independently of any trust, signature, or key validation, so no credentials or valid keys are needed. Impact is availability only (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), with confirmed exploitation limited to reachable configurations; EPSS is 0.16% (4th percentile), no CISA KEV listing, and no public exploit identified at time of analysis. Vendor-released patches are available in 4.2.4, 4.1.9, and 3.6.13, which introduce a configurable 10 MiB inflation cap.
Concurrent token-exchange requests against Apache CXF's JPA-backed OAuth2 authorization code grant provider can redeem a single authorization code more than once, yielding multiple valid access tokens from one code. Only deployments running the JPA authorization code provider that persists codes to a shared relational database under READ_COMMITTED isolation and that expose the token endpoint to remote callers are affected; versions below 3.6.13, 4.0.0 through 4.1.8, and 4.2.0 through 4.2.3 are in scope. Exploitation is unauthenticated per the CVSS vector (PR:N) but carries a high attack-complexity rating because the attacker must already hold one unredeemed code and win a timing race, so success is probabilistic; EPSS is low at 0.22% (11th percentile) and no public exploit identified at time of analysis, making this a real-but-conditional risk rather than a mass-exploitation emergency.
Authenticated non-admin users of Apache DolphinScheduler 3.2.0 up to (but not including) 3.4.3 can retrieve the Kubernetes kubeconfig that administrators stored for cluster integration, because the API that serves that data performs no authorization check (CWE-862). With the disclosed kubeconfig an attacker can authenticate directly to the Kubernetes API from outside DolphinScheduler, and the real-world severity is bounded by whatever privileges the embedded service account holds - cluster-admin-grade credentials expose Kubernetes Secrets and allow pod creation and persistence, while narrowly scoped credentials sharply limit what is achievable. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the issue is unreachable on deployments that never configured Kubernetes cluster integration or where the requester cannot obtain even a low-privileged account.
Broken authorization in Apache DolphinScheduler before 3.4.3 allows any authenticated user to retrieve connection details - including stored data source passwords - for data sources they are not authorized to access via the /unauth-datasource and /authed-datasource endpoints. Exploitation is network-reachable (AV:N), low complexity (AC:L), requires no user interaction (UI:N) and only a valid low-privileged account (PR:L), yielding high confidentiality impact (C:H) with no integrity or availability impact per our assessment; NVD/vendor scoring differs slightly by also crediting low integrity impact (I:L). Because the leaked credentials can be reused against the underlying databases, the practical consequence extends beyond information disclosure to potential downstream database compromise; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor-released fix is version 3.4.3.
Authenticated users of Apache DolphinScheduler can stop or create savepoints for task instances belonging to projects they are not authorized to access, because the project-scoped task-instance API fails to enforce per-project authorization. The issue affects all releases before 3.4.3 and is reachable over the network via the /dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/stop and /savepoint endpoints. The independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L (the vendor-published score is 8.1), meaning a valid authenticated account plus knowledge or enumeration of a target task instance ID is required - anonymous exploitation is not possible - and the practical impact is an integrity and limited availability concern in multi-tenant or multi-project deployments where project isolation is a security boundary; no public exploit code has been identified at time of analysis, EPSS is a low 0.16% (5th percentile), and the CVE is not in CISA KEV. This is a genuine but moderate-priority issue rather than a top-tier emergency.
Authorization bypass in Apache DolphinScheduler before 3.4.3 allows an authenticated user to alter task definitions, together with their upstream dependencies, in projects they are not authorized to access. The attacker pairs a projectCode they legitimately belong to with a task-definition code belonging to a different project when calling the /dolphinscheduler/projects/{projectCode}/task-definition/{code}/with-upstream endpoint, because the handler never confirms that the task code actually belongs to the supplied project. Impact is confined to integrity and availability of workflow definitions (assessed vector I:H/A:L, C:N), so unauthorized projects may have their pipelines silently rewritten or disrupted; no public exploit code has been identified at time of analysis and EPSS is only 0.18% (7th percentile), making this a genuine but moderate-priority issue rather than an urgent emergency.
Sensitive information is inserted into log files by the Apache Geode Web Management component in versions 2.0.0 through 2.0.2, so any party able to read those logs can recover the exposed confidential values (CWE-532, high confidentiality impact only). The NVD entry scores this 7.5 under CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, but our independent assessment applies AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - the practical constraint is obtaining access to the generated log output or a UI that surfaces it, so real-world exploitation is materially harder than the 7.5 network-vector score implies and authentication requirements are not settled by the available data. Exploitation is not confirmed actively exploited (CISA KEV does not list this CVE), no public exploit code has been identified at time of analysis, and EPSS is low at 0.17 percent (6th percentile), making this a moderate-priority information-disclosure issue rather than an urgent remote-compromise risk.
Session fixation and cross-user session reuse in the Apache Jackrabbit WebDAV server lets remote attackers ride on a cached authenticated session, yielding high confidentiality and integrity impact with no credential check performed. The flaw affects Jackrabbit 2.20.0 through 2.20.17, 2.22.0 through 2.22.4, and 2.23.0 through 2.23.5, and is triggered whenever a request carries a Lock-Token, TransactionId, SubscriptionId, or If-header token value that matches a token bound to a session already held in the server's authenticated session cache. Per the vendor CVSS 4.0 vector the attack is network-reachable, requires no privileges (PR:N) and no user interaction (UI:N), with the practical limiting factor being that the attacker must obtain or guess a token that currently maps to a live cached session; no public exploit code has been identified at time of analysis, and the product does not confirm active exploitation.
Stored cross-site scripting in the OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress affects every version up to and including 6.3.10, allowing unauthenticated attackers to inject arbitrary script through the 's' search parameter as it is handled by the plugin's comments-atom feed flow; the payload is written into a retained .tmp file and executes when a victim later loads the affected page or file. Exploitation is conditional rather than automatic: it only succeeds where the front-end web server serves that .tmp artifact without a Content-Type header and without X-Content-Type-Options: nosniff, so that a MIME-sniffing Chromium-based browser treats it as HTML and runs the script, a configuration the advisory notes is common by default on many Apache and nginx/php-fpm deployments. No public exploit code has been identified and the issue is not listed in CISA KEV; because the assessed vector requires high attack complexity and a non-sniffing or correctly-headered server blocks the attack entirely, this is a genuine but conditional, moderate-risk issue rather than a top-tier emergency. A vendor-released fix is available in 6.3.11.
Improper JWT/OAuth bearer-token validation in Apache Impala executors (versions 4.1.0 through 4.5.2) lets remote, unauthenticated attackers read resources exposed by an executor's internal webserver, because JWT signatures are never verified and any syntactically valid token is accepted. The exposure is conditional: it only applies where the executor webserver has been explicitly configured to accept JWT/OAuth bearer-token authentication, which is not the default, and the attacker must have network reachability to that webserver endpoint. EPSS is low (0.20%, ~9th percentile) and no public exploit code or confirmed active exploitation has been identified at time of analysis, but the flaw is trivially exploitable once the non-default configuration is in place; the assessed impact is high confidentiality with limited integrity loss, and the vendor fix is Impala 4.5.3 or disabling JWT/OAuth on executors.
Apache Commons BCEL before 6.13.0 caches attacker-supplied class files under the symbolic name declared inside the class file itself rather than validating that name against the name it was requested under, so a class loaded via AbstractClassPathRepository or ClassLoaderRepository can poison a repository entry keyed to a different, colliding name. Applications that load class files from an attacker-influenceable classpath or input stream and later rely on the repository's name-keyed lookups or verification results can be induced to operate on the wrong class, producing an integrity-only impact (no confidentiality or availability effect). The independent assessment rates this CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - network-reachable and unauthenticated, but requiring a specific name-collision and subsequent lookup sequence (AT:P), so it is not a fully automatable drive-in exploit; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor's elevated 8.2 CVSS 4.0 score reflects the integrity impact alone.
A race condition in Apache Struts' application-wide localization (i18n) text provider lets a message formatter that has been cached for one request be reused by concurrently served requests, so a date or time value belonging to one user can surface in another user's rendered response, or the formatting can fail and appear as a server error. The flaw affects Struts 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0; applications whose localized messages format no date or time arguments are explicitly not affected, which is the exact gating condition for exposure. No public exploit code or confirmed active exploitation has been identified, EPSS is low at 0.18% (7th percentile), and the outcome is timing-dependent and non-deterministic - leaking only values passed as date/time format arguments, not arbitrary memory - which is why our assessment (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L) is materially more conservative than the vendor's 8.8 score.
Resource exhaustion in Apache Struts 2.5.14 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0 allows an unauthenticated remote attacker to amplify a small request into a far larger response, consuming server CPU and outbound network capacity. The issue is conditional: the target application must bind a request parameter to a java.math.BigDecimal property and then render that property through the Struts tag library; applications missing either behavior are not affected per the advisory and independent assessment. No public exploit has been identified at time of analysis, EPSS is low at 0.28% (19th percentile), and the impact is availability-only (CVSS 7.5 with C:N/I:N/A:H).
OGNL expression injection in Apache Struts can lead to remote code execution, but only when an application is explicitly configured with the legacy RESTful action mapper - a non-default setting that standard deployments do not use. All version branches are affected in the abstract (2.0.0 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0), and on the Struts 7 branch exploitation additionally requires the OGNL allowlist to have been disabled, which is not the default. NVD rates this 9.8 (AV:N/AC:L/PR:N/UI:N), while our independent assessment lowers it to AC:H because the decisive limiting factor is the non-default mapper configuration; where that mapper is absent the flaw is not reachable. No public exploit code or CISA KEV entry has been identified at time of analysis, and EPSS is low at 0.36% (28th percentile), so exposure is driven principally by configuration review rather than by observed exploitation. Fixes are available in Struts 6.12.0 and 7.4.0.
Improper access control in Apache Traffic Server 9.0.0-9.2.14 and 10.0.0-10.1.3 allows unauthenticated remote requests that should have been denied to be forwarded to backend systems the proxy is meant to protect, yielding high confidentiality and integrity impact on those subsequent systems (SC:H/SI:H) with no direct impact on the Traffic Server host itself (VC:N/VI:N/VA:N). Exploitation is conditional, not routine: the CVSS 4.0 vector carries AT:P, meaning a specific attack requirement outside the attacker's direct control must be satisfied before a request succeeds, and this is corroborated by the independent assessment as a genuine but conditional risk rather than an urgent emergency. No public exploit code or confirmed active exploitation was identified at time of analysis; fixed versions are 9.2.15 and 10.1.4, and this CVE supersedes CVE-2026-41920, whose record understated the 9.x affected range as 9.0.0-9.1.14.
Opening a crafted untrusted document in Apache OpenOffice 4.1.16 and earlier can execute arbitrary code at the opening user's privilege level, including code fetched from a remote location, because the document's Java integration fails to authorize the external links it resolves. Exploitation is unauthenticated but requires user interaction: Java runtime integration must be enabled (the default configuration) and the victim must actively open an attacker-supplied file, making social engineering the primary delivery vector. There is no public exploit identified at time of analysis, no confirmed active exploitation (CISA KEV and SSVC both report none), and EPSS is only 0.22% (12th percentile); a vendor fix is expected in Apache OpenOffice 4.1.17, which is still in the release-candidate phase, so the recommended interim mitigation is to disable Java runtime integration in the Preferences dialog or to avoid opening untrusted documents entirely.
Uncontrolled resource allocation in Apache Thrift versions before 0.25.0 allows remote unauthenticated attackers to exhaust memory, CPU, or worker/connection capacity in services built on the C++, Java, Go, netstd, Python, and Delphi bindings (CWE-770), disrupting availability. The impact is availability-only - no confidentiality or integrity loss - rated CVSS 8.2 under CVSS 4.0, with the 4.0 AT:P flag and the independent CVSS:3.1 assessment (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) both indicating a specific condition must hold for the allocation to trigger, so exploitation is not guaranteed against every message or deployment. No public exploit code and no CISA KEV listing were identified at time of analysis; upgrading to 0.25.0 removes the condition entirely.
Denial of service in the Go language bindings of Apache Thrift affects all versions before 0.25.0, where resources are allocated without limits or throttling, allowing a remote unauthenticated client to exhaust server memory or other resources and take down the service. Per the assessed vector (AV:N/AC:L/PR:N/UI:N, availability-only impact), any Thrift Go server endpoint reachable over the network is exposed, with no confidentiality or integrity consequence; the practical exposure is narrowed by network reachability and by whether the deployment accepts Thrift traffic from untrusted clients. CISA KEV does not list this issue and no public exploit code was identified at time of analysis, so exploitation appears to require only a crafted or excessive-volume Thrift message rather than a published attack tool.
Denial of service in the Java bindings of Apache Thrift (all versions before 0.25.0) allows an accepted protocol peer to exhaust server resources by triggering unbounded allocation while Thrift messages are received and parsed. Per the assessed CVSS vector (PR:L), the attacker must already be an authenticated or otherwise accepted client of the Thrift service rather than an anonymous internet actor, which materially narrows exposure for deployments that only accept connections from trusted peers. The impact ceiling is availability loss only - no data disclosure, integrity impact, or code execution is declared - and no public exploit code or CISA KEV entry is associated with this CVE at time of analysis; the vendor-released fix is version 0.25.0.
Remote, unauthenticated attackers can crash applications built against Apache Thrift's c_glib (C/GLib) language bindings before version 0.25.0 by supplying crafted Thrift protocol input that triggers access of an uninitialized pointer (CWE-824), degrading availability with no confidentiality or integrity impact. The flaw carries a CVSS 4.0 score of 8.7 (assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and only deployments that use the c_glib binding and expose a Thrift endpoint to an attacker-reachable network are affected - services using Java, Python, Go or other bindings are not exposed to this particular defect. No public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation (CISA KEV); a vendor-released patch, version 0.25.0, is available.
Unauthenticated, network-reachable denial of service in Apache Thrift's PHP bindings before 0.25.0 lets attackers crash a Thrift service by sending crafted serialized messages that trigger a stack-based buffer overflow during protocol parsing. The vendor-supplied CVSS 4.0 score of 8.7 reflects high availability impact with no confidentiality or integrity impact (VC:N/VI:N/VA:H) and no privileges or user interaction required (PR:N/UI:N), and the assessed CVSS 3.1 vector agrees (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). No public exploit code or active exploitation has been identified at time of analysis, and the vendor scope bounds the consequence to service crash/denial of service rather than data disclosure or code execution.
Stack exhaustion in Apache Thrift before 0.25.0 allows remote, unauthenticated attackers to crash processes that deserialize attacker-controlled Thrift messages, because the protocol skip routine in several language bindings fails to apply the binding's recursion limit when skipping unknown fields. The affected bindings are the Python C++ accelerator (the pure-Python protocols are not affected), the PHP library and its thrift_protocol extension, and the Perl, Lua, Smalltalk and OCaml libraries; the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the bug is reachable over the network with no privileges or user interaction, but the impact metrics (VC:N/VI:N/VA:H) restrict the consequence to availability loss. There is no code execution or data exposure, no public exploit code and no confirmed active exploitation at time of analysis, and Apache has released version 0.25.0 which restores the recursion limit.
Denial of service in Apache Thrift's c_glib (C/GLib) language bindings before 0.25.0, where a crafted or malformed message reaching the deserialization/parsing path triggers a NULL pointer dereference and uninitialized-variable use that crashes the process. The issue is remotely reachable and unauthenticated (CVSS:4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with availability-high impact only), so any network-exposed Thrift service built on the c_glib binding is at risk of abrupt termination; confidentiality and integrity are unaffected. Only the c_glib binding is implicated - other Thrift bindings are not affected - and no public exploit code has been identified at time of analysis, with the vendor shipping a fix in 0.25.0.
Heap-based memory corruption in Apache Thrift versions before 0.25.0 lets unauthenticated remote attackers who can send Thrift protocol messages to a parsing service trigger an integer-overflow-driven undersized heap allocation followed by an out-of-bounds write, resulting in a crash (denial of service) or potentially attacker-controlled memory corruption with high confidentiality, integrity, and availability impact. The affected surface is any service that deserializes untrusted Thrift traffic; the CVSS v4.0 score of 9.2 reflects network reachability and no required privileges or user interaction, while the AC:H and AT:P metrics (mirrored by the assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicate that a successful exploit depends on crafting malformed messages that reliably hit the overflow condition and on runtime factors such as heap layout, memory limits, and the specific protocol/transport in use. No public exploit code or confirmed active exploitation was identified at time of analysis, but the framework's broad embedding in RPC and serialization pipelines makes prompt upgrade to 0.25.0 the clear priority. Services that never parse Thrift input from untrusted or remote peers are not reachable through this vector.
Denial of service in Apache Thrift's Go bindings (all versions before 0.25.0) allows an unauthenticated remote peer to crash an entire Thrift-serving process by sending a single crafted frame over the TFramedTransport or THeaderTransport. A frame that yields no payload bytes causes the transport to recurse into Read rather than loop, so a peer can drive unbounded recursion with only 4 bytes (declared frame size of zero) or 18 bytes (a header block that fills the frame) until the Go stack limit is hit; the resulting runtime fatal error is not catchable by recover() and kills the process. The impact is availability-only - no confidentiality or integrity effect - and no public exploit code has been identified at time of analysis, though exploitation needs only network reachability to the Thrift listener with no authentication or user interaction (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/.../VA:H).
Memory exhaustion in Apache Thrift's Node.js and D language WebSocket server transports (all versions before 0.25.0) lets unauthenticated remote attackers commit 513 MiB on a Node.js server, or up to 2 GiB on the D transport, by sending a single ~14-byte frame that merely declares a huge payload length. The transport reads the length out of the WebSocket frame header and allocates that many bytes immediately, before the payload has actually arrived, so an extremely small request causes disproportionate memory growth; in the Node.js case the connection is left open afterwards, allowing the same frame to be resent repeatedly until the service is exhausted or killed. Impact is limited to availability (CVSS 4.0 8.7, CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), no authentication or user interaction is required, and no public exploit code was identified at time of analysis. Affected deployments are those exposing the Thrift WebSocket server transport from the Node.js or D bindings; other Thrift transports and language bindings are out of scope.
Denial of service in Apache Thrift's c_glib (C/GLib) language bindings, affecting all versions before 0.25.0, where a crafted or malformed Thrift message can drive the decoder into an infinite loop with an unreachable exit condition (CWE-835). The issue is remotely reachable and requires no authentication per the published CVSS 4.0 vector (PR:N), though the AT:P attack-requirements flag and our independent CVSS 3.1 assessment (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) both indicate a specific input condition must be satisfied rather than arbitrary traffic. Impact is confined to availability - a hung thread, pinned CPU, or resource exhaustion that can stall or crash the service - with no data exposure, modification, or code execution; only applications that compile and use the c_glib bindings are affected, and no public exploit code has been identified at time of analysis. Upgrading to 0.25.0 removes the condition.
Denial of service in the PHP bindings of Apache Thrift before 0.25.0 allows unauthenticated remote attackers to exhaust process stack space and crash the parsing worker by supplying deeply nested or self-referential serialized Thrift messages. The flaw is an uncontrolled recursion (CWE-674) in the deserialization path, rated 8.2 High under CVSS 4.0 (AV:N/AC:L/AT:P/PR:N/UI:N/VA:H, with no confidentiality or integrity impact) and 8.2-equivalent High under the assessed CVSS 3.1 vector (A:H only), confirming that impact is confined to availability. Exploitation is not unconditional: the CVSS 4.0 AT:P attack-requirement flag reflects that the target service must actually accept and deserialize attacker-controllable Thrift payloads through the PHP bindings, so internal services processing only trusted, bounded data are not realistically exposed. There is no public exploit code and no confirmed active exploitation at time of analysis, and a vendor-released fix is available in Apache Thrift 0.25.0.
Denial of service in the Apache Thrift Perl bindings affects all releases before 0.25.0, allowing unauthenticated remote attackers to exhaust CPU or memory resources on services that deserialize attacker-controlled Thrift messages through the Perl language runtime. Only deployments using the Perl bindings are exposed; services built on the Java, Python, C++, or Go bindings are not affected by this specific flaw, and no public exploit code was identified at time of analysis, nor is there any CISA KEV confirmation of active exploitation. Impact is availability-only (no confidentiality or integrity loss), the vendor-released fix is Apache Thrift 0.25.0, and exploitation depends on the malicious input actually reaching the vulnerable parsing routine (the CVSS 4.0 AT:P / assessed AC:H condition).
Services that parse attacker-supplied input through Apache Thrift's Perl bindings before version 0.25.0 can be driven into an uncaught exception, crashing the hosting process or thread and causing a denial of service. The flaw is network-reachable and requires no authentication or user interaction (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N, score 8.2), but its impact is confined to availability (VA:H) with no confidentiality or integrity effect, and the CVSS 4.0 AT:P metric indicates a specific precondition - the attacker's input must actually reach the vulnerable Perl deserialization/handler path. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is resolved by the vendor's 0.25.0 release.
Uncaught exception handling in the Apache Thrift Ruby bindings lets unauthenticated remote attackers crash network-reachable Thrift RPC services running any version before 0.25.0. Per the assessed vector (AV:N/AC:L/PR:N/UI:N), no credentials, user interaction, or special configuration are required: any reachable Thrift Ruby service that parses attacker-supplied protocol messages can be knocked offline, though impact is limited to availability with no confidentiality or integrity loss. The flaw carries a CVSS 4.0 score of 8.7 (High) and an assessed CVSS 3.1 of 7.5, and no public exploit identified at time of analysis; exposure is confined to deployments using the Ruby language bindings rather than Thrift bindings for other languages.
Inefficient algorithmic complexity (CWE-407) in Apache Thrift's Lua bindings prior to version 0.25.0 allows remote, unauthenticated attackers to exhaust CPU and cause denial of service by supplying crafted input that the Lua binding parses. Only deployments that specifically use the Thrift Lua language binding and expose it to attacker-influenced data are affected; applications using other Thrift language bindings (Java, Python, C++, Go, etc.) are not impacted. The impact is limited to availability - no confidentiality or integrity loss is indicated by the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 8.7), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Denial of service in Apache Thrift's JavaME bindings (versions before 0.25.0) allows unauthenticated remote attackers to exhaust server resources by sending crafted Thrift protocol input, causing service outages. The flaw is CWE-770 (uncontrolled resource allocation) and is limited to availability impact; there is no confidentiality or integrity exposure. No public exploit code or active exploitation has been identified at time of analysis, and upgrading to 0.25.0 resolves the issue.
Unbounded resource allocation in the Ruby bindings of Apache Thrift (versions before 0.25.0) lets unauthenticated remote clients exhaust server memory or CPU by sending Thrift messages whose declared structure or container sizes trigger excessive allocation while the service deserializes them. Only network-reachable services that actually accept and parse untrusted Thrift payloads through the Ruby bindings are exposed, and the impact is confined to availability, with no data disclosure or modification (C:N/I:N/A:H). The Apache Software Foundation has released 0.25.0 as the fix; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor rates this 8.2 (High) under CVSS 4.0, while our independent assessment also treats it as High severity but notes a higher attack complexity (AC:H in v3.1 terms) because the attacker must reach a service that parses untrusted Thrift messages.
Denial of service in the Lua language bindings of Apache Thrift before 0.25.0 allows unauthenticated remote attackers to exhaust server resources by sending crafted Thrift messages that trigger uncontrolled allocation or inefficient algorithmic paths. The issue is limited to deployments that actively use the Lua bindings; other language bindings are unaffected. At time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified, and the impact is confined to availability-no data disclosure or code execution.
Denial of service in Apache Thrift Python bindings before 0.25.0 allows unauthenticated remote attackers to hang the service by sending crafted Thrift messages that drive the parser into an infinite loop (CWE-835). Exploitation is network-based but requires a specific condition, such as a particular protocol/transport or malformed message structure, to trigger the loop (AT:P / AC:H). The impact is limited to availability-no data disclosure or code execution-and only services exposing a Thrift endpoint that processes untrusted input using the Python bindings are affected; no public exploit code has been identified at time of analysis.
Denial of service in the Apache Thrift PHP bindings before version 0.25.0 allows unauthenticated remote attackers to exhaust server resources by sending crafted Thrift protocol messages that trigger inefficient algorithmic complexity (CWE-407). The vulnerability affects only applications that use the PHP bindings to deserialize untrusted Thrift input; other language bindings are unaffected. No public exploit code has been identified at the time of analysis, and the CVSS 4.0 AT:P metric indicates a specific attack precondition must be met, so exploitation is not guaranteed against every deployment.
Denial of service in the Dart language bindings of Apache Thrift before 0.25.0 allows unauthenticated remote attackers to exhaust server memory and CPU by sending crafted Thrift messages to a network-reachable Dart-based service that deserializes untrusted input (CWE-770, allocation of resources without limits or throttling). Impact is limited to availability (service slowdown or crash); there is no confidentiality or integrity consequence, and deployments using other Thrift language bindings such as C++, Java, Python or Go are not affected. No public exploit code was identified at time of analysis and the vendor-released fix that resolves the issue is Apache Thrift 0.25.0.
Denial of service in the Apache Thrift Node.js bindings (all versions before 0.25.0) lets remote, unauthenticated attackers crash the hosting Node.js process by delivering a crafted Thrift message that triggers an uncaught exception during deserialization. The vendor-supplied CVSS 4.0 score of 8.7 is driven entirely by availability impact (VA:H) with no confidentiality or integrity impact (VC:N/VI:N), and our independent assessment maps this to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - no authentication, user interaction, or non-default configuration is required, so any deployment that parses untrusted Thrift input over the network is exposed. The practical risk is bounded by reachability: services that only accept trusted internal Thrift traffic are far less exposed. No public exploit code or confirmed active exploitation was identified at time of analysis. The description also cites improper validation of input quantities and prototype pollution, but the assessed impact per the vendor metrics remains availability-only.
Denial of service in Apache Thrift's Go bindings (versions before 0.25.0) lets unauthenticated remote attackers exhaust memory or CPU by sending highly compressed payloads over a compressed transport, so a tiny request expands into a disproportionately large in-memory buffer (CWE-409 data amplification / decompression bomb). Exploitation is conditional: per the vendor's CVSS 4.0 score the AT:P metric applies, meaning the affected service must actually accept attacker-supplied compressed data (for example a zlib-backed transport carrying untrusted input) - deployments of the Go bindings that do not parse compressed payloads from external sources are not exposed. Impact is availability-only (service crash, hang, or memory exhaustion) with no code execution or data disclosure; no public exploit code and no confirmed active exploitation were identified at time of analysis, and our independent assessment uses a 3.1 vector of AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H reflecting that precondition.
Denial of service in Apache Thrift's Python bindings before 0.25.0 arises from improper handling of highly compressed data (CWE-409), letting a remote, unauthenticated attacker send a small compressed Thrift payload that expands dramatically during parsing and exhausts server memory or CPU. Exploitation requires a service that accepts externally supplied Thrift data and decompresses or size-expands it, and the impact is confined to availability with no data disclosure or code execution. No public exploit code has been identified at time of analysis, and upgrading to 0.25.0 eliminates the vulnerability.
Denial of service in the D-language binding of Apache Thrift (thrift.server.nonblocking.TNonblockingServer) allows unauthenticated remote attackers to crash the server by sending a crafted or malformed message that provokes an uncaught exception and improper resource shutdown. Only deployments built with the D binding at versions before 0.25.0 and specifically using TNonblockingServer are affected, and the impact is limited to availability with no data exposure or modification. No public exploit code has been identified at time of analysis, and the vendor has released version 0.25.0 to fix the issue.
Unauthenticated remote attackers can crash applications that use the Apache Thrift PHP bindings prior to version 0.25.0 by supplying crafted Thrift protocol messages that trigger a NULL pointer dereference (CWE-476). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates the flaw is remotely reachable with low complexity and requires no authentication or user interaction, but the impact profile is availability-only (VC:N/VI:N/VA:H) - there is no confidentiality or integrity exposure, so the 8.7 score reflects a pure denial-of-service outcome rather than code execution. Exploitation is conditional on the target PHP service actually accepting and deserializing attacker-controlled Thrift input, and no public exploit code has been identified at time of analysis. A vendor patch is available in Apache Thrift 0.25.0, which per the advisory fixes the issue.
Denial of service in Apache Thrift deployments that use the D language bindings before version 0.25.0, where malformed input reaching the service endpoint triggers an uncaught exception, an infinite loop with an unreachable exit condition, and an integer underflow that can crash or hang the service. The assessed impact is availability-only (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; vendor CVSS 4.0 base 8.7), meaning unauthenticated remote attackers who can reach a D-bindings Thrift service need no credentials, user interaction, or non-default configuration to cause disruption. Exposure is narrow because only services compiled against the D bindings are affected - Java, Python, C++, Go and other language binding deployments are not - and no public exploit code has been identified at time of analysis.
Denial of service and limited integrity tampering in Apache Thrift before 0.25.0 stem from a combination of an infinite loop (CWE-835) and prototype pollution in the Node.js bindings when the TJSONProtocol deserializer parses crafted JSON. Any application exposing a Thrift service built on the Node.js library with TJSONProtocol enabled on an untrusted, attacker-reachable input path can be driven into an unreachable-exit loop that hangs the process, with secondary risk of object prototype attribute manipulation altering application state; the vulnerability is reachable unauthenticated and without user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, availability High, integrity Low) and the vendor rates it 8.7. No public exploit code has been identified at time of analysis and the issue is not recorded as actively exploited, though the affected product family and the low attack complexity make it a realistic target for opportunistic scanning. Risk is bounded by deployment: services using TBinaryProtocol, TCompactProtocol or non-Node.js Thrift bindings are not affected by this vector.
Integer underflow in Apache Thrift's C++ THeaderTransport can wrap a length or offset calculation and produce an out-of-bounds write, allowing a network attacker to crash or destabilize services that parse THeader-framed messages. The exposure is narrow: the library must be compiled as a 32-bit binary and must actually use THeaderTransport, while 64-bit builds and services relying on other transports are not affected, so the realistic outcome is denial of service rather than code execution or data disclosure. Affected releases are Apache Thrift before 0.25.0; no public exploit code has been identified at time of analysis, and the vendor's own scoring reflects availability-only impact (VA:H with no confidentiality or integrity effect).
Memory exhaustion in Apache Thrift before 0.25.0 lets unauthenticated remote attackers crash services that deserialize attacker-controlled Thrift messages, and the flaw is present across the Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin, and D language bindings. The supplied CVSS 4.0 vector (8.7 High) and the independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) agree that impact is availability-only: no confidentiality or integrity loss, and no authentication, user interaction, or special configuration is required beyond a reachable endpoint that accepts untrusted Thrift input. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV); the vendor-released fix is version 0.25.0.
Denial of service in Apache Thrift's Erlang bindings affects all releases before 0.25.0, where unauthenticated remote attackers who can reach a Thrift service that parses untrusted serialized input can send deeply nested or otherwise resource-heavy messages that the Erlang deserialization code processes without recursion-depth or allocation limits. The result is uncontrolled recursion and unbounded resource consumption (CWE-674), leading to service crash or hang - availability impact only, with no confidentiality or integrity loss confirmed. Exploitation requires the specific precondition that the target actually parses the attacker-supplied payload (CVSS 4.0 AT:P), and the flaw is confined to the Erlang bindings rather than all Thrift language bindings, so this is a moderate-priority availability issue rather than a top-tier emergency; no public exploit code has been identified at time of analysis, and the vendor-released fix is Apache Thrift 0.25.0.
Denial of service in the Lua language bindings of Apache Thrift allows unauthenticated remote attackers to exhaust CPU resources by supplying pathologically crafted input to a regular-expression or parsing code path in releases before 0.25.0, consistent with CWE-1333 (inefficient regular expression complexity). The CVSS 4.0 vector scores 8.2 with AT:P, indicating that a specific attack prerequisite must be met: the deployment must actually use the Lua bindings and attacker-controlled data must reach the vulnerable parsing path, so exploitation is not fully attacker-controlled. The vendor-released fix is Apache Thrift 0.25.0; no public exploit code was identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing), with the effective risk concentrated in services that parse untrusted input through the Lua binding.
Denial of service in Apache Thrift Node.js bindings before 0.25.0 allows unauthenticated remote attackers who can reach a Thrift listener to send a crafted or malformed message that triggers an uncaught exception and terminates the Node.js process. The vendor CVSS 4.0 score is 8.7 and the independently assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, so impact is availability-only with no confidentiality or integrity loss. Only the Node.js language bindings are affected; no public exploit identified at time of analysis.
Resource-exhaustion denial of service in Apache Thrift's Java TSaslNonblockingServer component allows remote attackers to drive the service into an unresponsive state by consuming server resources without limit (CWE-770). All Apache Thrift releases before 0.25.0 are affected, and the CVSS:4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) confirms the attack is network-reachable and requires no credentials or user interaction once an exposed TSaslNonblockingServer endpoint is reachable; impact is confined to availability, with no confidentiality or integrity loss. Exploitation is only possible against deployments that specifically use the Java non-blocking SASL server class, which limits real-world exposure since blocking servers and non-SASL configurations are unaffected; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this is a patch-now hygiene item rather than an emergency.
Denial of service in the Erlang language bindings of Apache Thrift before 0.25.0 allows remote attackers to exhaust server resources through unbounded allocation, degrading or crashing the affected service. The flaw is CWE-770 (Allocation of Resources Without Limits or Throttling) and carries a CVSS v4.0 base score of 8.2; our independent assessment scores it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, reflecting a high-availability-only impact that requires a specific crafted message structure (AT:P) rather than arbitrary traffic. Only deployments running a Thrift server compiled with the Erlang bindings and exposed to attacker-reachable network traffic are affected; users of the C++, Java, Python, Go and other bindings are not impacted, and no public exploit code was identified at time of analysis.
An uncaught exception (CWE-248) in Apache Thrift's PHP language bindings before 0.25.0 allows unauthenticated remote attackers to terminate PHP processes that accept arbitrary Thrift protocol input, producing a denial of service with no confidentiality or integrity impact. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) means no privileges or user interaction are required against a default deployment that exposes a vulnerable PHP-based Thrift endpoint to untrusted network traffic; the practical prerequisite is that the target actually uses the PHP bindings rather than another language binding. No public exploit code and no confirmed active exploitation were identified at time of analysis, and exploitation potential is bounded to service availability - this is a genuine but limited availability risk rather than a data-breach emergency.
Denial of service in the Apache Thrift PHP bindings before 0.25.0 allows unauthenticated remote attackers who can reach a Thrift service built on those bindings to exhaust server resources via unbounded allocation. The flaw is CWE-770 (allocation of resources without limits or throttling), triggered when the PHP binding processes attacker-controllable message sizes or collections without a cap; impact is limited to availability (VA:H; VC:N/VI:N), meaning no data disclosure or code execution. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), so risk is highest for externally reachable Thrift endpoints that accept untrusted clients. Vendor-released patch: 0.25.0.
Unbounded resource allocation in the Node.js bindings of Apache Thrift (all versions before 0.25.0) allows remote, unauthenticated attackers to exhaust memory and crash an exposed Thrift service by sending a crafted message whose declared quantity/size field is not validated before allocation. Impact is limited to availability: no confidentiality or integrity effect, and no code execution is achievable through this path. Exploitation requires a Node.js binding deployment that actually parses untrusted client input (the assessed AT:P condition), and because only the Node.js bindings below 0.25.0 are affected, deployments using other language bindings or newer versions are not exposed; there is no public exploit code identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV).
Uncontrolled recursion in Apache Thrift's c_glib (C/GLib) bindings causes stack exhaustion and process crash when a crafted, deeply nested message is deserialized from an untrusted source. Only applications built against the c_glib bindings at versions before 0.25.0 are affected; deployments using the Java, Python, C++ or other language bindings are not impacted by this specific issue. The flaw is availability-only - no confidentiality or integrity loss - and is reachable over the network without authentication (CVSS:4.0 PR:N, AT:P), though exploitation depends on the recursive parsing path being exposed to attacker-controlled input; no public exploit code or confirmed active exploitation was identified at time of analysis.
Repeated, attacker-triggered exceptional conditions in the Apache Thrift Java bindings can leak server-side resources and degrade or exhaust a Thrift RPC service running any version before 0.25.0. The issue is remotely reachable without authentication (CVSS PR:N) and needs no user interaction, but the assessed impact is availability only - there is no confirmed confidentiality or integrity effect, so this is a denial-of-service exposure rather than a data-compromise issue. A CVSS 4.0 attack-requirement flag (AT:P) indicates a specific precondition must be met to drive the vulnerable error path, meaning not every request triggers the leak; the precise condition is not specified in the public advisory text, and no public exploit identified at time of analysis. Deployments not using the Java bindings, or already on 0.25.0 or later, are unaffected.
Uncontrolled recursion in the Dart and Java ME bindings of Apache Thrift before 0.25.0 lets a remote, unauthenticated attacker crash or hang a service by sending a Thrift message containing deeply nested or self-referential structures that exhaust the parser's stack. Impact is availability-only (no confidentiality or integrity effect per the assessed CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and the vulnerable surface is confined to deployments that deserialize untrusted data using the Dart or Java ME bindings, so most Thrift users on Java SE, C++, Python, or Go are not exposed. No public exploit code or confirmed active exploitation was identified at time of analysis; the CVSS 4.0 base score of 8.7 should be read alongside the narrow binding-specific exposure, which makes real-world priority moderate rather than critical.
Sensitive-information exposure in Apache Kylin versions 4 through 5.0.4 permits an authenticated user to obtain data they are not authorized to see, with confidentiality impact rated High while integrity and availability are unaffected. The Apache Kylin project addressed the flaw in version 5.0.5; because the upstream advisory names neither the specific endpoint, feature, nor configuration that triggers the disclosure, the exact attack path must be confirmed against the advisory thread. Risk signals are currently sparse - no CVSS vector or score was supplied with the CVE, no EPSS probability, no CISA KEV listing, and no public exploit code are present in the available data, so this cannot be ranked as a confirmed priority, and no public exploit has been identified at time of analysis.
Unauthenticated SQL injection in Apache Kylin 5.0.0 through 5.0.4 allows a remote attacker who can reach a specific backend cache API endpoint to bypass the missing authentication check and reach SQL-executing logic, with the injected statement executed by the Kylin service (assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L). Per Apache's advisory, practical exposure is concentrated on Kylin instances directly reachable from the public internet - the vendor characterizes this as uncommon - while in-house deployments confined to trusted internal networks are mostly not impacted, so the operative precondition is network reachability of the service rather than any configuration toggle. No CVSS vector from the vendor, EPSS score, KEV listing, or public exploit code was provided in the available intelligence, so no public exploit has been identified at time of analysis and quantitative exploitation signals are absent; severity rests on the vulnerability class and the vendor's own scoping. A fixed release exists in Apache Kylin 5.0.5.
Unauthenticated exposure of system-level configuration information in Apache Kylin 4.0.0 through 5.0.4 lets any client that can reach the Kylin service retrieve sensitive deployment details, rated CVSS 3.1 base 7.5 (HIGH) with high confidentiality impact but no integrity or availability effect. Per the assessed vector (AV:N/AC:L/PR:N/UI:N), no authentication, user interaction, or non-default configuration is required, so default-reachable instances are exposed; exposure is limited mainly by whether the instance is network-reachable, and deployments confined to internal networks or placed behind authenticating proxies are significantly less at risk. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied, so prioritization should be driven by network exposure of Kylin installations rather than by observed exploitation. Upgrading to 5.0.5 is the vendor-recommended fix.
Remote code execution via arbitrary file upload affects the YaySMTP WordPress plugin in all versions up to and including 2.7.7, where an authenticated subscriber-level user can upload executable files through the putFile function. The plugin relies on sanitize_file_name() without an allow-list, MIME check, or safe-extension rename, and its only server-side guard is a .htaccess file with 'Require all denied' that nginx and Apache with AllowOverride None ignore, so full RCE is achievable on those configurations. No public exploit code was identified at time of analysis and there is no confirmed CISA KEV active exploitation; exploitation requires authentication at subscriber level or above, which is commonly available when open user registration is enabled.
Apache Answer through 2.0.2 fails to enforce content visibility in its reaction API, letting any remote, unauthenticated client read reaction metadata attached to visibility-restricted (private or limited-audience) posts and comments and add or remove its own reactions against content it is not authorized to see. Impact is bounded - reaction metadata and the attacker's own reaction state are exposed, not the restricted content body - and the vendor rates the issue moderate; there is no server-side availability or broader integrity impact. Apache Answer 2.0.3 fixes the issue; no public exploit identified at time of analysis, and exploitation only matters on deployments that combine visibility-restricted content with the reaction feature.
Missing authorization checks in Apache Answer through 2.0.2 let an authenticated user perform mutations on non-public content they are not permitted to access, producing limited confidentiality and integrity impact on the affected instance rather than account or host takeover. Assessed severity is moderate (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) and the flaw requires a valid account, making instances that allow open or self-service registration the most exposed. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV); upgrading to Apache Answer 2.0.3 is the fix.
Improper authorization in Apache Answer 2.0.2 and earlier allows holders of a valid global API key to retrieve answer content tied to questions that are hidden, deleted, or still pending review. The defect is in the MCP (Model Context Protocol) answer-retrieval tool, which returns content without honoring the per-question visibility state, so an authenticated key holder - an insider, a third-party integration, or anyone using a leaked key - can read material the Q&A platform intended to withhold. It is not reachable by anonymous remote attackers, impact is limited to information disclosure with no modification or denial of service, and no public exploit identified at time of analysis; CISA KEV does not list this issue.
Apache Answer 2.0.2 and earlier records full API keys in plaintext in application logs on every authenticated request, so anyone able to read those logs - via local filesystem access, a shared or centralized logging pipeline, a backup, or a compromised logging account - can recover active bearer tokens and replay them against the platform. The prerequisite of log read access is the dominant limiting factor: this is not exploitable against the public interface by an unauthenticated internet attacker, and no public exploit code or active exploitation has been identified at time of analysis. It is a genuinely low-priority credential-disclosure issue whose real-world severity depends on how widely Answer's logs are distributed and how long tokens remain valid.
Resource exhaustion in Apache Kylin 4.0.0 through 5.0.4 lets an attacker who already holds project admin permission abuse a cache API to drive computed-column processing into unbounded resource allocation, degrading or denying availability of the Kylin service. The weakness is reachable only by authenticated users with high privileges (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L), so a compromised or malicious project administrator account is a prerequisite; there is no confidentiality or integrity impact and no public exploit identified at time of analysis. Severity is low, no CISA KEV entry or public exploit exists, and the vendor-released fix is Kylin 5.0.5 (tracked as KYLIN-6112).
Unauthenticated access to Apache Kylin's in-house broadcast API combined with polymorphic deserialization of attacker-supplied data exposes Kylin 4.0.0 through 5.0.4 to high-impact compromise of the affected service, assessed as network-reachable without privileges or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vendor classifies the issue as 'moderate' severity but notes that practical risk is concentrated on Kylin instances whose broadcast endpoint is directly reachable from a public network, which Apache describes as 'not common'; typical internal-only deployments are considered largely unimpacted. No CISA KEV entry, EPSS score, or public exploit code was present in the source data, so there is no public exploit identified at time of analysis, and this assessment rests almost entirely on the Apache advisory, which recommends upgrading to Apache Kylin 5.0.5.
Missing authorization on the JDBC source-configuration update function in Apache Kylin 4.0.0 through 5.0.4 allows an authenticated, low-privileged user to modify a project's data-source connection settings, producing a high integrity impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) with only limited confidentiality exposure and no availability impact. The vendor explicitly frames exposure as network-bounded: risk is concentrated on Kylin services directly reachable from the public network, described as uncommon, while in-house deployments behind network controls are mostly not impacted. No public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was supplied with the source data.
Unauthenticated metadata broadcast processing in Apache Kylin 4.0.4 through 5.0.4 allows remote attackers who can reach the affected broadcast/metadata-processing endpoint to bypass authentication and have limited impact on confidentiality and integrity of the service. Per the vendor's own advisory, the exposure is largely confined to the in-house (cluster/internal) network, so the realistic high-impact scenario requires the non-default and explicitly "not common" condition of a Kylin service being directly reachable from the public network; Kylin deployments upgraded to 5.0.5 or kept off the internet are the primary limiting factors. This is a moderate-severity issue (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, i.e. unauthenticated, no user interaction, low confidentiality and integrity impact) and there is no public exploit identified at time of analysis and no CISA KEV listing; the flaw is tracked upstream as KYLIN-6107.
Broken access control in Apache Kylin 4.0.0 through 5.0.4 allows a remote, unauthenticated actor to read the server's configured SQL blacklist through the QuerySQLBlacklistController endpoint (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). The exposed asset is limited to the blacklist configuration itself - no query data, credentials, or code execution - but the disclosure can reveal which query patterns are being blocked, which may help an attacker tailor queries that evade those governance controls. There is no public exploit code and no confirmed active exploitation (CISA KEV) at time of analysis; Apache has fixed the flaw in Kylin 5.0.5.
Unauthorized cross-project job manipulation in Apache Kylin 4.0.0 through 5.0.4 allows an authenticated user with a valid account in one project to operate on job records belonging to projects they are not a member of, because the JobController component does not enforce project-scoped authorization (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L). The vendor rates the issue 'important' but explicitly scopes real-world impact to Kylin services directly reachable from the public network, which it describes as uncommon; in-house, network-isolated deployments are largely unaffected. No publicly available exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was available; upgrading to Apache Kylin 5.0.5 removes the condition.
Apache Airflow's SSH and SFTP provider hooks accept any server host key by default, so an attacker positioned as a machine-in-the-middle between an Airflow worker and an SSH or SFTP endpoint can impersonate that server and capture task credentials or transferred data. All releases of apache-airflow-providers-ssh and apache-airflow-providers-sftp before 7.0.0 are affected when a connection has neither host_key configured nor no_host_key_check explicitly disabled; the assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, i.e. unauthenticated from the attacker's side but gated on the high-complexity MITM prerequisite, which is why the input's 9.1 rating overstates practical urgency. No public exploit code has been identified and EPSS is only 0.18% (7th percentile); vendor patches (provider 7.0.0) are released, and the related deferrable-SFTP path is tracked separately as CVE-2026-94135, which the same SFTP 7.0.0 release also fixes.
OAuth1 request replay in Apache Allura through 1.21.0 lets a remote, unauthenticated attacker reuse a previously captured OAuth1-signed request to act with the original requester's authorization, because the platform does not adequately enforce nonce/timestamp single-use. The practical barrier is high rather than trivial: the attacker must first obtain a genuine signed request from a legitimate user - most plausibly through network interception, a man-in-the-middle position, or access to logged or leaked requests - and the replay only yields the scope of that specific captured request rather than arbitrary access, which is why the attack-complexity is assessed as high (AC:H) despite the PR:N vector. No public exploit code and no confirmed active exploitation were identified at time of analysis; EPSS is low at roughly 0.15% (4th percentile), so mass scanning is unlikely, though the vendor has published a fix in Apache Allura 1.22.0.
Remote unauthenticated attackers can manipulate object attributes through the Apache Allura REST API in versions up to and including 1.21.0, because the API's object-binding logic (CWE-915, mass assignment) fails to whitelist which client-supplied fields may be written. The published CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, giving a base score of 9.1 with high confidentiality and integrity impact and no availability impact, and no user interaction or credentials are required per that vector, though the practical exposure is limited by the small, largely self-hosted population of Allura instances and whether the affected write endpoints are reachable or gated behind authentication in a given deployment. Exploitation does not appear to be widespread: EPSS is only 0.29% (20th percentile), there is no CISA KEV listing, and no public exploit code was identified at time of analysis; the vendor-released fix is Apache Allura 1.22.0.
Open redirect flaw in the OAuth1 callback validation of Apache Allura through 1.21.0 allows unauthenticated remote attackers to redirect users to arbitrary attacker-controlled URLs during the OAuth authorization flow (CWE-601), potentially exposing authorization codes or tokens if a victim completes the flow. Exploitation is not drive-by: per the independent assessment a user must be induced to traverse the attacker-influenced OAuth request (UI:R), which lowers real-world risk below the supplied 9.1 base score; the vendor patched the issue in Allura 1.22.0, no public exploit identified at time of analysis, and EPSS is 0.15% (4th percentile), so this is assessed as a moderate real-world priority.
Out-of-bounds read in Apache DataSketches C++ (datasketches-cpp) allows an attacker who controls a serialized VarOpt union image to trigger reads of up to 24 bytes past the end of the supplied buffer, causing a crash (denial of service) and potentially leaking adjacent heap memory into the deserialized union's state. Applications are exposed only if they call var_opt_union::deserialize() on data from untrusted sources; affected releases are 2.0.0-incubating through 5.2.0, and the library is not exploitable on its own. No public exploit code has been identified at time of analysis, EPSS is low at 0.24% (14th percentile), and the issue is not listed in CISA KEV, so the practical priority is moderate rather than urgent. The vendor-released fix is version 5.3.0, which also remediates four other deserialization flaws.
Out-of-bounds read in Apache DataSketches C++ versions 3.1.0 through 5.2.0 is reachable when an application deserializes a compact Theta sketch from an untrusted source, allowing unauthenticated remote attackers to crash the process (denial of service) and potentially disclose adjacent memory contents. The flaw sits in compact_theta_sketch::deserialize() and wrapped_compact_theta_sketch::wrap(), which parse header fields before verifying the input length; in the compressed format a 32-bit integer overflow defeats the length check and two decoding-controlling header fields go unvalidated, and the stream-based deserialization path is affected as well. Apache rates this issue low severity in its 5.3.0 release notes, no public exploit code has been identified at time of analysis, the vulnerability is not in CISA KEV, and EPSS is only 0.20% (9th percentile); exploitation requires the explicit, non-default precondition that the host application accept Theta sketch images from untrusted sources, so the practical priority is lower than the raw 9.1 CVSS might suggest.
Out-of-bounds read and write in the CPC sketch deserialization path of Apache DataSketches C++ (datasketches-cpp) - specifically cpc_sketch::deserialize() called on a byte buffer or a stream - allows a crafted serialized sketch to corrupt heap memory: the decompressor reads past the end of the compressed data because the read position was only checked after decoding finished, and in the hybrid flavor it writes outside an internal heap buffer because decoded row indices were not validated, crashing the process with potential for further exploitation. All releases from 2.0.0-incubating before 5.3.0 are affected, and the CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating remote, unauthenticated impact, but reachability is conditional: only applications that deserialize CPC sketches from untrusted sources are exposed, since the flaw lives in a C++ library whose attack surface depends on the embedding application. Exploitation signals are mixed and should be weighed carefully - EPSS is only 0.19% (8th percentile), there is no CISA KEV entry, and no public exploit identified at time of analysis.
Heap buffer overflow in Apache DataSketches C++ (versions 1.0.0-incubating through 5.2.0) allows an unauthenticated remote attacker who can supply a crafted HLL sketch for deserialization to write up to 988 bytes past a fixed 8-entry internal heap buffer, corrupting memory, crashing the process, and potentially enabling further exploitation. The vulnerable code is a library routine with no network listener of its own, so real-world exposure hinges on whether the consuming application deserializes sketch images from untrusted byte buffers or streams; services that only process trusted or internally generated sketches are not realistically exposed despite the AV:N vector. No public exploit code has been identified at time of analysis, and EPSS is low at 0.21% (11th percentile), while the assessed CVSS 3.1 base of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects the worst case for applications that do accept untrusted sketches, meaning the high score and low observed exploitation signal must be weighed together.
Code injection in the Fastcache by Host.it WordPress plugin (all versions up to and including 1.7.4) allows an authenticated administrator-level user to write arbitrary Apache directives into the site's .htaccess file, which can be escalated to full remote code execution by setting php_value auto_prepend_file to load attacker-controlled PHP on every request. Exploitation requires the PR:H vector from the assessed CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H score (7.2), i.e. a logged-in account with administrator privileges, and is further conditioned on the site running Apache with an .htaccess file the plugin can write and an AllowOverride configuration that honors php_value directives - on nginx or Apache with AllowOverride None the injected directives have no effect. No public exploit code was identified at time of analysis and the flaw is not listed in CISA KEV; this is a genuine but access-gated privilege-to-RCE escalation rather than a mass-exploitable perimeter bug.
Any authenticated user of Apache Camel Karavan 4.0.0 up to (but not including) 4.22.1 - regardless of role - can push arbitrary Kubernetes resources into the cluster through the deployment workflow. When a deployment is started, Karavan unmarshals the project's kubernetes.yaml and applies every resource it contains without restricting resource kinds, rejecting security-sensitive pod options (hostNetwork, hostPID, hostIPC, hostPath volumes, host ports, privileged containers, privilege escalation, added capabilities), or pinning a target namespace. The vendor score is 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), while the independent assessment scores it scope-changed (S:C) because successful exploitation escapes the Karavan namespace boundary; the practical blast radius is capped by the RBAC permissions granted to Karavan's Kubernetes service account. There is no CISA KEV listing and no public exploit code identified at time of analysis, and the issue is fixed in 4.22.1.
Path traversal in Apache Camel Karavan 3.18.0 through 4.22.0 allows an authenticated user of any role to write arbitrary files outside the project directory by supplying a project file name containing '../' sequences, leading to overwrite of application configuration or classpath files and potential remote code execution in the Karavan container. The flaw is present in default behavior and requires only a valid account (CVSS 8.8, PR:L). No public exploit code or active exploitation has been identified at time of analysis, but the high impact and low privilege requirement make this a genuine high-priority issue.
Apache CXF versions prior to 4.2.4, 4.1.9, and 3.6.13 allow remote, unauthenticated attackers to cause a denial of service by submitting a very large XML document that exhausts memory and CPU during parsing. The flaw lies in StaxUtils, which by default imposes no limit on the total number of elements or characters, and is most impactful when CXF builds a DOM from the input, such as in SAAJ or WS-Security processing. No public exploit code has been identified, and deployments that enforce a request size limit are largely protected.
Man-in-the-middle attackers can impersonate any TLS server contacted by Apache CXF's optional Netty-based HTTP client transport, because cxf-rt-transports-http-netty-client validates the server certificate chain against the configured trust store but never checks that the certificate's hostname matches the host actually being called - a gap present over both HTTP/1.1 and HTTP/2 and present even with disableCNCheck left at its secure default of false. Applications running Apache CXF before 3.6.13, 4.1.9 or 4.2.4 that use this transport for outbound TLS calls are affected; an unauthenticated attacker who already holds a traffic-interception position and any certificate issued by a CA in the client's trust store (for example, a free publicly issued certificate for an attacker-controlled domain) can read or modify exchanged messages and credentials. No public exploit identified at time of analysis, and exploitation is gated by the requirement for an on-path MITM position plus a trusted-chain certificate, which is reflected in our assessed vector returning High attack complexity rather than the published AC:L; EPSS is correspondingly low at 0.11% (1st percentile), so this is a serious TLS trust failure rather than an immediate mass-exploitation priority. Vendor fixes are available in 3.6.13, 4.1.9 and 4.2.4.
Unbounded memory allocation in Apache CXF's multipart/MTOM attachment part-header parser lets a remote, unauthenticated attacker exhaust server memory and cause a denial of service by sending a single crafted multipart request. The parser applies attachment-max-header-size (default 300 characters) only per physical line and enforces attachment-headers-max-count (default 500) against distinct header names rather than total header lines, so folded continuation lines or a repeated header name slip past both limits and inflate the parsed value without bound. Affected are CXF 4.2.0 through 4.2.3, 4.0.0 through 4.1.8, and all releases before 3.6.13 that expose a multipart/MTOM-accepting endpoint; fixed releases are 4.2.4, 4.1.9 and 3.6.13. Exploitation requires no authentication (CVSS PR:N/UI:N) and no non-default configuration, but it is limited to availability impact only; EPSS is low at 0.24% (14th percentile) and no public exploit code or confirmed active exploitation was identified at time of analysis.
XML signature wrapping in Apache CXF's JAX-RS XML Security module allows remote, unauthenticated attackers to have unsigned content accepted as if it were covered by a trusted XML signature. Only deployments that consume inbound XML through CXF's XML Signature interceptors (XmlSigInHandler, XmlSigInInterceptor, or the streaming XmlSecInInterceptor) are exposed, and the attacker must first hold any XML document signed by a key the target trusts; that signed document can then be wrapped in forged content and repeatedly presented. Fixed versions 4.2.4, 4.1.9, and 3.6.13 address the issue; no public exploit code has been identified and EPSS is low (0.17%, 6th percentile), though integrity impact is rated High (CVSS 7.5).
Trust bypass in Apache CXF's STSTokenValidator allows a remote, unauthenticated attacker to have a forged SAML assertion signed with an untrusted certificate accepted as trusted without the assertion ever being validated by the Security Token Service. Only deployments that use STSTokenValidator to validate SAML tokens while leaving alwaysValidateToSts unset are affected, and exploitation additionally requires a race window in which the result of a concurrent legitimate request's successful trust check is read from shared state. No public exploit code or CISA KEV listing has been identified at time of analysis, EPSS is 0.17% (6th percentile), and vendor fixes are available in Apache CXF 4.2.4, 4.1.9 and 3.6.13.
Token validation bypass in Apache CXF's STSTokenValidator and Security Token Service (STS) allows unauthenticated remote attackers to impersonate another user by presenting a forged UsernameToken or self-signed SAML Assertion whose 32-bit Java hash collides with an entry already held in the validated-token cache. Because a cache hit is treated as proof of prior validation, the forged token is accepted without password validation, signature trust verification, or any call to the STS, and can subsequently be exchanged through STS validation or renewal for STS-signed tokens issued for the victim identity. Exploitation is constrained in practice: the target deployment must use STSTokenValidator or STS token validation/renewal with the validated-token cache enabled, and a legitimately validated token for the identity being impersonated must already be present in that cache; no public exploit code has been identified at time of analysis, KEV status is negative, and EPSS is low (~0.17%, 6th percentile), yet the headline CVSS of 9.1 reflects high confidentiality and integrity impact if the preconditions are met. Vendor patches are available in 4.2.4, 4.1.9, and 3.6.13.
CPU exhaustion denial of service in Apache CXF's FIQL query parser allows remote attackers to degrade or stall a server by submitting a long search expression containing no recognizable operator, which drives the parser's operator-search logic into excessive combinatorial matching and burns CPU on a request-handling thread. Affected are CXF 3.6.x, 4.1.x and 4.2.x deployments that expose FIQL-based search/filter endpoints; the assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (base 7.5), meaning availability impact only, with confidentiality and integrity unaffected. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor-released fixes - 4.2.4, 4.1.9 and 3.6.13 - neutralize the long-input vector by capping FIQL expressions at 4 KiB by default while still permitting normal queries.
A remote, unauthenticated attacker can exhaust server heap memory in Apache CXF by submitting a small (kilobyte-scale) DEFLATE payload that inflates to gigabytes when the framework decompresses it without any output-size cap. The flaw is reachable through two deployment-specific paths: JWE decryption when the 'zip=DEF' compression header is present (for example a JoseSessionTokenProvider configured with RSA-OAEP key wrap), and SAML token inflation over the HTTP redirect or POST binding - in both cases decompression occurs before or independently of any trust, signature, or key validation, so no credentials or valid keys are needed. Impact is availability only (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), with confirmed exploitation limited to reachable configurations; EPSS is 0.16% (4th percentile), no CISA KEV listing, and no public exploit identified at time of analysis. Vendor-released patches are available in 4.2.4, 4.1.9, and 3.6.13, which introduce a configurable 10 MiB inflation cap.
Concurrent token-exchange requests against Apache CXF's JPA-backed OAuth2 authorization code grant provider can redeem a single authorization code more than once, yielding multiple valid access tokens from one code. Only deployments running the JPA authorization code provider that persists codes to a shared relational database under READ_COMMITTED isolation and that expose the token endpoint to remote callers are affected; versions below 3.6.13, 4.0.0 through 4.1.8, and 4.2.0 through 4.2.3 are in scope. Exploitation is unauthenticated per the CVSS vector (PR:N) but carries a high attack-complexity rating because the attacker must already hold one unredeemed code and win a timing race, so success is probabilistic; EPSS is low at 0.22% (11th percentile) and no public exploit identified at time of analysis, making this a real-but-conditional risk rather than a mass-exploitation emergency.
Authenticated non-admin users of Apache DolphinScheduler 3.2.0 up to (but not including) 3.4.3 can retrieve the Kubernetes kubeconfig that administrators stored for cluster integration, because the API that serves that data performs no authorization check (CWE-862). With the disclosed kubeconfig an attacker can authenticate directly to the Kubernetes API from outside DolphinScheduler, and the real-world severity is bounded by whatever privileges the embedded service account holds - cluster-admin-grade credentials expose Kubernetes Secrets and allow pod creation and persistence, while narrowly scoped credentials sharply limit what is achievable. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the issue is unreachable on deployments that never configured Kubernetes cluster integration or where the requester cannot obtain even a low-privileged account.
Broken authorization in Apache DolphinScheduler before 3.4.3 allows any authenticated user to retrieve connection details - including stored data source passwords - for data sources they are not authorized to access via the /unauth-datasource and /authed-datasource endpoints. Exploitation is network-reachable (AV:N), low complexity (AC:L), requires no user interaction (UI:N) and only a valid low-privileged account (PR:L), yielding high confidentiality impact (C:H) with no integrity or availability impact per our assessment; NVD/vendor scoring differs slightly by also crediting low integrity impact (I:L). Because the leaked credentials can be reused against the underlying databases, the practical consequence extends beyond information disclosure to potential downstream database compromise; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor-released fix is version 3.4.3.
Authenticated users of Apache DolphinScheduler can stop or create savepoints for task instances belonging to projects they are not authorized to access, because the project-scoped task-instance API fails to enforce per-project authorization. The issue affects all releases before 3.4.3 and is reachable over the network via the /dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/stop and /savepoint endpoints. The independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L (the vendor-published score is 8.1), meaning a valid authenticated account plus knowledge or enumeration of a target task instance ID is required - anonymous exploitation is not possible - and the practical impact is an integrity and limited availability concern in multi-tenant or multi-project deployments where project isolation is a security boundary; no public exploit code has been identified at time of analysis, EPSS is a low 0.16% (5th percentile), and the CVE is not in CISA KEV. This is a genuine but moderate-priority issue rather than a top-tier emergency.
Authorization bypass in Apache DolphinScheduler before 3.4.3 allows an authenticated user to alter task definitions, together with their upstream dependencies, in projects they are not authorized to access. The attacker pairs a projectCode they legitimately belong to with a task-definition code belonging to a different project when calling the /dolphinscheduler/projects/{projectCode}/task-definition/{code}/with-upstream endpoint, because the handler never confirms that the task code actually belongs to the supplied project. Impact is confined to integrity and availability of workflow definitions (assessed vector I:H/A:L, C:N), so unauthorized projects may have their pipelines silently rewritten or disrupted; no public exploit code has been identified at time of analysis and EPSS is only 0.18% (7th percentile), making this a genuine but moderate-priority issue rather than an urgent emergency.
Sensitive information is inserted into log files by the Apache Geode Web Management component in versions 2.0.0 through 2.0.2, so any party able to read those logs can recover the exposed confidential values (CWE-532, high confidentiality impact only). The NVD entry scores this 7.5 under CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, but our independent assessment applies AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - the practical constraint is obtaining access to the generated log output or a UI that surfaces it, so real-world exploitation is materially harder than the 7.5 network-vector score implies and authentication requirements are not settled by the available data. Exploitation is not confirmed actively exploited (CISA KEV does not list this CVE), no public exploit code has been identified at time of analysis, and EPSS is low at 0.17 percent (6th percentile), making this a moderate-priority information-disclosure issue rather than an urgent remote-compromise risk.
Session fixation and cross-user session reuse in the Apache Jackrabbit WebDAV server lets remote attackers ride on a cached authenticated session, yielding high confidentiality and integrity impact with no credential check performed. The flaw affects Jackrabbit 2.20.0 through 2.20.17, 2.22.0 through 2.22.4, and 2.23.0 through 2.23.5, and is triggered whenever a request carries a Lock-Token, TransactionId, SubscriptionId, or If-header token value that matches a token bound to a session already held in the server's authenticated session cache. Per the vendor CVSS 4.0 vector the attack is network-reachable, requires no privileges (PR:N) and no user interaction (UI:N), with the practical limiting factor being that the attacker must obtain or guess a token that currently maps to a live cached session; no public exploit code has been identified at time of analysis, and the product does not confirm active exploitation.
Stored cross-site scripting in the OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress affects every version up to and including 6.3.10, allowing unauthenticated attackers to inject arbitrary script through the 's' search parameter as it is handled by the plugin's comments-atom feed flow; the payload is written into a retained .tmp file and executes when a victim later loads the affected page or file. Exploitation is conditional rather than automatic: it only succeeds where the front-end web server serves that .tmp artifact without a Content-Type header and without X-Content-Type-Options: nosniff, so that a MIME-sniffing Chromium-based browser treats it as HTML and runs the script, a configuration the advisory notes is common by default on many Apache and nginx/php-fpm deployments. No public exploit code has been identified and the issue is not listed in CISA KEV; because the assessed vector requires high attack complexity and a non-sniffing or correctly-headered server blocks the attack entirely, this is a genuine but conditional, moderate-risk issue rather than a top-tier emergency. A vendor-released fix is available in 6.3.11.
Improper JWT/OAuth bearer-token validation in Apache Impala executors (versions 4.1.0 through 4.5.2) lets remote, unauthenticated attackers read resources exposed by an executor's internal webserver, because JWT signatures are never verified and any syntactically valid token is accepted. The exposure is conditional: it only applies where the executor webserver has been explicitly configured to accept JWT/OAuth bearer-token authentication, which is not the default, and the attacker must have network reachability to that webserver endpoint. EPSS is low (0.20%, ~9th percentile) and no public exploit code or confirmed active exploitation has been identified at time of analysis, but the flaw is trivially exploitable once the non-default configuration is in place; the assessed impact is high confidentiality with limited integrity loss, and the vendor fix is Impala 4.5.3 or disabling JWT/OAuth on executors.
Apache Commons BCEL before 6.13.0 caches attacker-supplied class files under the symbolic name declared inside the class file itself rather than validating that name against the name it was requested under, so a class loaded via AbstractClassPathRepository or ClassLoaderRepository can poison a repository entry keyed to a different, colliding name. Applications that load class files from an attacker-influenceable classpath or input stream and later rely on the repository's name-keyed lookups or verification results can be induced to operate on the wrong class, producing an integrity-only impact (no confidentiality or availability effect). The independent assessment rates this CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - network-reachable and unauthenticated, but requiring a specific name-collision and subsequent lookup sequence (AT:P), so it is not a fully automatable drive-in exploit; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor's elevated 8.2 CVSS 4.0 score reflects the integrity impact alone.
A race condition in Apache Struts' application-wide localization (i18n) text provider lets a message formatter that has been cached for one request be reused by concurrently served requests, so a date or time value belonging to one user can surface in another user's rendered response, or the formatting can fail and appear as a server error. The flaw affects Struts 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0; applications whose localized messages format no date or time arguments are explicitly not affected, which is the exact gating condition for exposure. No public exploit code or confirmed active exploitation has been identified, EPSS is low at 0.18% (7th percentile), and the outcome is timing-dependent and non-deterministic - leaking only values passed as date/time format arguments, not arbitrary memory - which is why our assessment (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L) is materially more conservative than the vendor's 8.8 score.
Resource exhaustion in Apache Struts 2.5.14 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0 allows an unauthenticated remote attacker to amplify a small request into a far larger response, consuming server CPU and outbound network capacity. The issue is conditional: the target application must bind a request parameter to a java.math.BigDecimal property and then render that property through the Struts tag library; applications missing either behavior are not affected per the advisory and independent assessment. No public exploit has been identified at time of analysis, EPSS is low at 0.28% (19th percentile), and the impact is availability-only (CVSS 7.5 with C:N/I:N/A:H).
OGNL expression injection in Apache Struts can lead to remote code execution, but only when an application is explicitly configured with the legacy RESTful action mapper - a non-default setting that standard deployments do not use. All version branches are affected in the abstract (2.0.0 through 2.3.37, 2.5.0 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0), and on the Struts 7 branch exploitation additionally requires the OGNL allowlist to have been disabled, which is not the default. NVD rates this 9.8 (AV:N/AC:L/PR:N/UI:N), while our independent assessment lowers it to AC:H because the decisive limiting factor is the non-default mapper configuration; where that mapper is absent the flaw is not reachable. No public exploit code or CISA KEV entry has been identified at time of analysis, and EPSS is low at 0.36% (28th percentile), so exposure is driven principally by configuration review rather than by observed exploitation. Fixes are available in Struts 6.12.0 and 7.4.0.
Improper access control in Apache Traffic Server 9.0.0-9.2.14 and 10.0.0-10.1.3 allows unauthenticated remote requests that should have been denied to be forwarded to backend systems the proxy is meant to protect, yielding high confidentiality and integrity impact on those subsequent systems (SC:H/SI:H) with no direct impact on the Traffic Server host itself (VC:N/VI:N/VA:N). Exploitation is conditional, not routine: the CVSS 4.0 vector carries AT:P, meaning a specific attack requirement outside the attacker's direct control must be satisfied before a request succeeds, and this is corroborated by the independent assessment as a genuine but conditional risk rather than an urgent emergency. No public exploit code or confirmed active exploitation was identified at time of analysis; fixed versions are 9.2.15 and 10.1.4, and this CVE supersedes CVE-2026-41920, whose record understated the 9.x affected range as 9.0.0-9.1.14.
Opening a crafted untrusted document in Apache OpenOffice 4.1.16 and earlier can execute arbitrary code at the opening user's privilege level, including code fetched from a remote location, because the document's Java integration fails to authorize the external links it resolves. Exploitation is unauthenticated but requires user interaction: Java runtime integration must be enabled (the default configuration) and the victim must actively open an attacker-supplied file, making social engineering the primary delivery vector. There is no public exploit identified at time of analysis, no confirmed active exploitation (CISA KEV and SSVC both report none), and EPSS is only 0.22% (12th percentile); a vendor fix is expected in Apache OpenOffice 4.1.17, which is still in the release-candidate phase, so the recommended interim mitigation is to disable Java runtime integration in the Preferences dialog or to avoid opening untrusted documents entirely.
Uncontrolled resource allocation in Apache Thrift versions before 0.25.0 allows remote unauthenticated attackers to exhaust memory, CPU, or worker/connection capacity in services built on the C++, Java, Go, netstd, Python, and Delphi bindings (CWE-770), disrupting availability. The impact is availability-only - no confidentiality or integrity loss - rated CVSS 8.2 under CVSS 4.0, with the 4.0 AT:P flag and the independent CVSS:3.1 assessment (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) both indicating a specific condition must hold for the allocation to trigger, so exploitation is not guaranteed against every message or deployment. No public exploit code and no CISA KEV listing were identified at time of analysis; upgrading to 0.25.0 removes the condition entirely.
Denial of service in the Go language bindings of Apache Thrift affects all versions before 0.25.0, where resources are allocated without limits or throttling, allowing a remote unauthenticated client to exhaust server memory or other resources and take down the service. Per the assessed vector (AV:N/AC:L/PR:N/UI:N, availability-only impact), any Thrift Go server endpoint reachable over the network is exposed, with no confidentiality or integrity consequence; the practical exposure is narrowed by network reachability and by whether the deployment accepts Thrift traffic from untrusted clients. CISA KEV does not list this issue and no public exploit code was identified at time of analysis, so exploitation appears to require only a crafted or excessive-volume Thrift message rather than a published attack tool.
Denial of service in the Java bindings of Apache Thrift (all versions before 0.25.0) allows an accepted protocol peer to exhaust server resources by triggering unbounded allocation while Thrift messages are received and parsed. Per the assessed CVSS vector (PR:L), the attacker must already be an authenticated or otherwise accepted client of the Thrift service rather than an anonymous internet actor, which materially narrows exposure for deployments that only accept connections from trusted peers. The impact ceiling is availability loss only - no data disclosure, integrity impact, or code execution is declared - and no public exploit code or CISA KEV entry is associated with this CVE at time of analysis; the vendor-released fix is version 0.25.0.
Remote, unauthenticated attackers can crash applications built against Apache Thrift's c_glib (C/GLib) language bindings before version 0.25.0 by supplying crafted Thrift protocol input that triggers access of an uninitialized pointer (CWE-824), degrading availability with no confidentiality or integrity impact. The flaw carries a CVSS 4.0 score of 8.7 (assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and only deployments that use the c_glib binding and expose a Thrift endpoint to an attacker-reachable network are affected - services using Java, Python, Go or other bindings are not exposed to this particular defect. No public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation (CISA KEV); a vendor-released patch, version 0.25.0, is available.
Unauthenticated, network-reachable denial of service in Apache Thrift's PHP bindings before 0.25.0 lets attackers crash a Thrift service by sending crafted serialized messages that trigger a stack-based buffer overflow during protocol parsing. The vendor-supplied CVSS 4.0 score of 8.7 reflects high availability impact with no confidentiality or integrity impact (VC:N/VI:N/VA:H) and no privileges or user interaction required (PR:N/UI:N), and the assessed CVSS 3.1 vector agrees (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). No public exploit code or active exploitation has been identified at time of analysis, and the vendor scope bounds the consequence to service crash/denial of service rather than data disclosure or code execution.
Stack exhaustion in Apache Thrift before 0.25.0 allows remote, unauthenticated attackers to crash processes that deserialize attacker-controlled Thrift messages, because the protocol skip routine in several language bindings fails to apply the binding's recursion limit when skipping unknown fields. The affected bindings are the Python C++ accelerator (the pure-Python protocols are not affected), the PHP library and its thrift_protocol extension, and the Perl, Lua, Smalltalk and OCaml libraries; the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the bug is reachable over the network with no privileges or user interaction, but the impact metrics (VC:N/VI:N/VA:H) restrict the consequence to availability loss. There is no code execution or data exposure, no public exploit code and no confirmed active exploitation at time of analysis, and Apache has released version 0.25.0 which restores the recursion limit.
Denial of service in Apache Thrift's c_glib (C/GLib) language bindings before 0.25.0, where a crafted or malformed message reaching the deserialization/parsing path triggers a NULL pointer dereference and uninitialized-variable use that crashes the process. The issue is remotely reachable and unauthenticated (CVSS:4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with availability-high impact only), so any network-exposed Thrift service built on the c_glib binding is at risk of abrupt termination; confidentiality and integrity are unaffected. Only the c_glib binding is implicated - other Thrift bindings are not affected - and no public exploit code has been identified at time of analysis, with the vendor shipping a fix in 0.25.0.
Heap-based memory corruption in Apache Thrift versions before 0.25.0 lets unauthenticated remote attackers who can send Thrift protocol messages to a parsing service trigger an integer-overflow-driven undersized heap allocation followed by an out-of-bounds write, resulting in a crash (denial of service) or potentially attacker-controlled memory corruption with high confidentiality, integrity, and availability impact. The affected surface is any service that deserializes untrusted Thrift traffic; the CVSS v4.0 score of 9.2 reflects network reachability and no required privileges or user interaction, while the AC:H and AT:P metrics (mirrored by the assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicate that a successful exploit depends on crafting malformed messages that reliably hit the overflow condition and on runtime factors such as heap layout, memory limits, and the specific protocol/transport in use. No public exploit code or confirmed active exploitation was identified at time of analysis, but the framework's broad embedding in RPC and serialization pipelines makes prompt upgrade to 0.25.0 the clear priority. Services that never parse Thrift input from untrusted or remote peers are not reachable through this vector.
Denial of service in Apache Thrift's Go bindings (all versions before 0.25.0) allows an unauthenticated remote peer to crash an entire Thrift-serving process by sending a single crafted frame over the TFramedTransport or THeaderTransport. A frame that yields no payload bytes causes the transport to recurse into Read rather than loop, so a peer can drive unbounded recursion with only 4 bytes (declared frame size of zero) or 18 bytes (a header block that fills the frame) until the Go stack limit is hit; the resulting runtime fatal error is not catchable by recover() and kills the process. The impact is availability-only - no confidentiality or integrity effect - and no public exploit code has been identified at time of analysis, though exploitation needs only network reachability to the Thrift listener with no authentication or user interaction (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/.../VA:H).
Memory exhaustion in Apache Thrift's Node.js and D language WebSocket server transports (all versions before 0.25.0) lets unauthenticated remote attackers commit 513 MiB on a Node.js server, or up to 2 GiB on the D transport, by sending a single ~14-byte frame that merely declares a huge payload length. The transport reads the length out of the WebSocket frame header and allocates that many bytes immediately, before the payload has actually arrived, so an extremely small request causes disproportionate memory growth; in the Node.js case the connection is left open afterwards, allowing the same frame to be resent repeatedly until the service is exhausted or killed. Impact is limited to availability (CVSS 4.0 8.7, CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), no authentication or user interaction is required, and no public exploit code was identified at time of analysis. Affected deployments are those exposing the Thrift WebSocket server transport from the Node.js or D bindings; other Thrift transports and language bindings are out of scope.
Denial of service in Apache Thrift's c_glib (C/GLib) language bindings, affecting all versions before 0.25.0, where a crafted or malformed Thrift message can drive the decoder into an infinite loop with an unreachable exit condition (CWE-835). The issue is remotely reachable and requires no authentication per the published CVSS 4.0 vector (PR:N), though the AT:P attack-requirements flag and our independent CVSS 3.1 assessment (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) both indicate a specific input condition must be satisfied rather than arbitrary traffic. Impact is confined to availability - a hung thread, pinned CPU, or resource exhaustion that can stall or crash the service - with no data exposure, modification, or code execution; only applications that compile and use the c_glib bindings are affected, and no public exploit code has been identified at time of analysis. Upgrading to 0.25.0 removes the condition.
Denial of service in the PHP bindings of Apache Thrift before 0.25.0 allows unauthenticated remote attackers to exhaust process stack space and crash the parsing worker by supplying deeply nested or self-referential serialized Thrift messages. The flaw is an uncontrolled recursion (CWE-674) in the deserialization path, rated 8.2 High under CVSS 4.0 (AV:N/AC:L/AT:P/PR:N/UI:N/VA:H, with no confidentiality or integrity impact) and 8.2-equivalent High under the assessed CVSS 3.1 vector (A:H only), confirming that impact is confined to availability. Exploitation is not unconditional: the CVSS 4.0 AT:P attack-requirement flag reflects that the target service must actually accept and deserialize attacker-controllable Thrift payloads through the PHP bindings, so internal services processing only trusted, bounded data are not realistically exposed. There is no public exploit code and no confirmed active exploitation at time of analysis, and a vendor-released fix is available in Apache Thrift 0.25.0.
Denial of service in the Apache Thrift Perl bindings affects all releases before 0.25.0, allowing unauthenticated remote attackers to exhaust CPU or memory resources on services that deserialize attacker-controlled Thrift messages through the Perl language runtime. Only deployments using the Perl bindings are exposed; services built on the Java, Python, C++, or Go bindings are not affected by this specific flaw, and no public exploit code was identified at time of analysis, nor is there any CISA KEV confirmation of active exploitation. Impact is availability-only (no confidentiality or integrity loss), the vendor-released fix is Apache Thrift 0.25.0, and exploitation depends on the malicious input actually reaching the vulnerable parsing routine (the CVSS 4.0 AT:P / assessed AC:H condition).
Services that parse attacker-supplied input through Apache Thrift's Perl bindings before version 0.25.0 can be driven into an uncaught exception, crashing the hosting process or thread and causing a denial of service. The flaw is network-reachable and requires no authentication or user interaction (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N, score 8.2), but its impact is confined to availability (VA:H) with no confidentiality or integrity effect, and the CVSS 4.0 AT:P metric indicates a specific precondition - the attacker's input must actually reach the vulnerable Perl deserialization/handler path. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is resolved by the vendor's 0.25.0 release.
Uncaught exception handling in the Apache Thrift Ruby bindings lets unauthenticated remote attackers crash network-reachable Thrift RPC services running any version before 0.25.0. Per the assessed vector (AV:N/AC:L/PR:N/UI:N), no credentials, user interaction, or special configuration are required: any reachable Thrift Ruby service that parses attacker-supplied protocol messages can be knocked offline, though impact is limited to availability with no confidentiality or integrity loss. The flaw carries a CVSS 4.0 score of 8.7 (High) and an assessed CVSS 3.1 of 7.5, and no public exploit identified at time of analysis; exposure is confined to deployments using the Ruby language bindings rather than Thrift bindings for other languages.
Inefficient algorithmic complexity (CWE-407) in Apache Thrift's Lua bindings prior to version 0.25.0 allows remote, unauthenticated attackers to exhaust CPU and cause denial of service by supplying crafted input that the Lua binding parses. Only deployments that specifically use the Thrift Lua language binding and expose it to attacker-influenced data are affected; applications using other Thrift language bindings (Java, Python, C++, Go, etc.) are not impacted. The impact is limited to availability - no confidentiality or integrity loss is indicated by the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 8.7), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Denial of service in Apache Thrift's JavaME bindings (versions before 0.25.0) allows unauthenticated remote attackers to exhaust server resources by sending crafted Thrift protocol input, causing service outages. The flaw is CWE-770 (uncontrolled resource allocation) and is limited to availability impact; there is no confidentiality or integrity exposure. No public exploit code or active exploitation has been identified at time of analysis, and upgrading to 0.25.0 resolves the issue.
Unbounded resource allocation in the Ruby bindings of Apache Thrift (versions before 0.25.0) lets unauthenticated remote clients exhaust server memory or CPU by sending Thrift messages whose declared structure or container sizes trigger excessive allocation while the service deserializes them. Only network-reachable services that actually accept and parse untrusted Thrift payloads through the Ruby bindings are exposed, and the impact is confined to availability, with no data disclosure or modification (C:N/I:N/A:H). The Apache Software Foundation has released 0.25.0 as the fix; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor rates this 8.2 (High) under CVSS 4.0, while our independent assessment also treats it as High severity but notes a higher attack complexity (AC:H in v3.1 terms) because the attacker must reach a service that parses untrusted Thrift messages.
Denial of service in the Lua language bindings of Apache Thrift before 0.25.0 allows unauthenticated remote attackers to exhaust server resources by sending crafted Thrift messages that trigger uncontrolled allocation or inefficient algorithmic paths. The issue is limited to deployments that actively use the Lua bindings; other language bindings are unaffected. At time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified, and the impact is confined to availability-no data disclosure or code execution.
Denial of service in Apache Thrift Python bindings before 0.25.0 allows unauthenticated remote attackers to hang the service by sending crafted Thrift messages that drive the parser into an infinite loop (CWE-835). Exploitation is network-based but requires a specific condition, such as a particular protocol/transport or malformed message structure, to trigger the loop (AT:P / AC:H). The impact is limited to availability-no data disclosure or code execution-and only services exposing a Thrift endpoint that processes untrusted input using the Python bindings are affected; no public exploit code has been identified at time of analysis.
Denial of service in the Apache Thrift PHP bindings before version 0.25.0 allows unauthenticated remote attackers to exhaust server resources by sending crafted Thrift protocol messages that trigger inefficient algorithmic complexity (CWE-407). The vulnerability affects only applications that use the PHP bindings to deserialize untrusted Thrift input; other language bindings are unaffected. No public exploit code has been identified at the time of analysis, and the CVSS 4.0 AT:P metric indicates a specific attack precondition must be met, so exploitation is not guaranteed against every deployment.
Denial of service in the Dart language bindings of Apache Thrift before 0.25.0 allows unauthenticated remote attackers to exhaust server memory and CPU by sending crafted Thrift messages to a network-reachable Dart-based service that deserializes untrusted input (CWE-770, allocation of resources without limits or throttling). Impact is limited to availability (service slowdown or crash); there is no confidentiality or integrity consequence, and deployments using other Thrift language bindings such as C++, Java, Python or Go are not affected. No public exploit code was identified at time of analysis and the vendor-released fix that resolves the issue is Apache Thrift 0.25.0.
Denial of service in the Apache Thrift Node.js bindings (all versions before 0.25.0) lets remote, unauthenticated attackers crash the hosting Node.js process by delivering a crafted Thrift message that triggers an uncaught exception during deserialization. The vendor-supplied CVSS 4.0 score of 8.7 is driven entirely by availability impact (VA:H) with no confidentiality or integrity impact (VC:N/VI:N), and our independent assessment maps this to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - no authentication, user interaction, or non-default configuration is required, so any deployment that parses untrusted Thrift input over the network is exposed. The practical risk is bounded by reachability: services that only accept trusted internal Thrift traffic are far less exposed. No public exploit code or confirmed active exploitation was identified at time of analysis. The description also cites improper validation of input quantities and prototype pollution, but the assessed impact per the vendor metrics remains availability-only.
Denial of service in Apache Thrift's Go bindings (versions before 0.25.0) lets unauthenticated remote attackers exhaust memory or CPU by sending highly compressed payloads over a compressed transport, so a tiny request expands into a disproportionately large in-memory buffer (CWE-409 data amplification / decompression bomb). Exploitation is conditional: per the vendor's CVSS 4.0 score the AT:P metric applies, meaning the affected service must actually accept attacker-supplied compressed data (for example a zlib-backed transport carrying untrusted input) - deployments of the Go bindings that do not parse compressed payloads from external sources are not exposed. Impact is availability-only (service crash, hang, or memory exhaustion) with no code execution or data disclosure; no public exploit code and no confirmed active exploitation were identified at time of analysis, and our independent assessment uses a 3.1 vector of AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H reflecting that precondition.
Denial of service in Apache Thrift's Python bindings before 0.25.0 arises from improper handling of highly compressed data (CWE-409), letting a remote, unauthenticated attacker send a small compressed Thrift payload that expands dramatically during parsing and exhausts server memory or CPU. Exploitation requires a service that accepts externally supplied Thrift data and decompresses or size-expands it, and the impact is confined to availability with no data disclosure or code execution. No public exploit code has been identified at time of analysis, and upgrading to 0.25.0 eliminates the vulnerability.
Denial of service in the D-language binding of Apache Thrift (thrift.server.nonblocking.TNonblockingServer) allows unauthenticated remote attackers to crash the server by sending a crafted or malformed message that provokes an uncaught exception and improper resource shutdown. Only deployments built with the D binding at versions before 0.25.0 and specifically using TNonblockingServer are affected, and the impact is limited to availability with no data exposure or modification. No public exploit code has been identified at time of analysis, and the vendor has released version 0.25.0 to fix the issue.
Unauthenticated remote attackers can crash applications that use the Apache Thrift PHP bindings prior to version 0.25.0 by supplying crafted Thrift protocol messages that trigger a NULL pointer dereference (CWE-476). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates the flaw is remotely reachable with low complexity and requires no authentication or user interaction, but the impact profile is availability-only (VC:N/VI:N/VA:H) - there is no confidentiality or integrity exposure, so the 8.7 score reflects a pure denial-of-service outcome rather than code execution. Exploitation is conditional on the target PHP service actually accepting and deserializing attacker-controlled Thrift input, and no public exploit code has been identified at time of analysis. A vendor patch is available in Apache Thrift 0.25.0, which per the advisory fixes the issue.
Denial of service in Apache Thrift deployments that use the D language bindings before version 0.25.0, where malformed input reaching the service endpoint triggers an uncaught exception, an infinite loop with an unreachable exit condition, and an integer underflow that can crash or hang the service. The assessed impact is availability-only (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; vendor CVSS 4.0 base 8.7), meaning unauthenticated remote attackers who can reach a D-bindings Thrift service need no credentials, user interaction, or non-default configuration to cause disruption. Exposure is narrow because only services compiled against the D bindings are affected - Java, Python, C++, Go and other language binding deployments are not - and no public exploit code has been identified at time of analysis.
Denial of service and limited integrity tampering in Apache Thrift before 0.25.0 stem from a combination of an infinite loop (CWE-835) and prototype pollution in the Node.js bindings when the TJSONProtocol deserializer parses crafted JSON. Any application exposing a Thrift service built on the Node.js library with TJSONProtocol enabled on an untrusted, attacker-reachable input path can be driven into an unreachable-exit loop that hangs the process, with secondary risk of object prototype attribute manipulation altering application state; the vulnerability is reachable unauthenticated and without user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, availability High, integrity Low) and the vendor rates it 8.7. No public exploit code has been identified at time of analysis and the issue is not recorded as actively exploited, though the affected product family and the low attack complexity make it a realistic target for opportunistic scanning. Risk is bounded by deployment: services using TBinaryProtocol, TCompactProtocol or non-Node.js Thrift bindings are not affected by this vector.
Integer underflow in Apache Thrift's C++ THeaderTransport can wrap a length or offset calculation and produce an out-of-bounds write, allowing a network attacker to crash or destabilize services that parse THeader-framed messages. The exposure is narrow: the library must be compiled as a 32-bit binary and must actually use THeaderTransport, while 64-bit builds and services relying on other transports are not affected, so the realistic outcome is denial of service rather than code execution or data disclosure. Affected releases are Apache Thrift before 0.25.0; no public exploit code has been identified at time of analysis, and the vendor's own scoring reflects availability-only impact (VA:H with no confidentiality or integrity effect).
Memory exhaustion in Apache Thrift before 0.25.0 lets unauthenticated remote attackers crash services that deserialize attacker-controlled Thrift messages, and the flaw is present across the Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin, and D language bindings. The supplied CVSS 4.0 vector (8.7 High) and the independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) agree that impact is availability-only: no confidentiality or integrity loss, and no authentication, user interaction, or special configuration is required beyond a reachable endpoint that accepts untrusted Thrift input. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV); the vendor-released fix is version 0.25.0.
Denial of service in Apache Thrift's Erlang bindings affects all releases before 0.25.0, where unauthenticated remote attackers who can reach a Thrift service that parses untrusted serialized input can send deeply nested or otherwise resource-heavy messages that the Erlang deserialization code processes without recursion-depth or allocation limits. The result is uncontrolled recursion and unbounded resource consumption (CWE-674), leading to service crash or hang - availability impact only, with no confidentiality or integrity loss confirmed. Exploitation requires the specific precondition that the target actually parses the attacker-supplied payload (CVSS 4.0 AT:P), and the flaw is confined to the Erlang bindings rather than all Thrift language bindings, so this is a moderate-priority availability issue rather than a top-tier emergency; no public exploit code has been identified at time of analysis, and the vendor-released fix is Apache Thrift 0.25.0.
Denial of service in the Lua language bindings of Apache Thrift allows unauthenticated remote attackers to exhaust CPU resources by supplying pathologically crafted input to a regular-expression or parsing code path in releases before 0.25.0, consistent with CWE-1333 (inefficient regular expression complexity). The CVSS 4.0 vector scores 8.2 with AT:P, indicating that a specific attack prerequisite must be met: the deployment must actually use the Lua bindings and attacker-controlled data must reach the vulnerable parsing path, so exploitation is not fully attacker-controlled. The vendor-released fix is Apache Thrift 0.25.0; no public exploit code was identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing), with the effective risk concentrated in services that parse untrusted input through the Lua binding.
Denial of service in Apache Thrift Node.js bindings before 0.25.0 allows unauthenticated remote attackers who can reach a Thrift listener to send a crafted or malformed message that triggers an uncaught exception and terminates the Node.js process. The vendor CVSS 4.0 score is 8.7 and the independently assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, so impact is availability-only with no confidentiality or integrity loss. Only the Node.js language bindings are affected; no public exploit identified at time of analysis.
Resource-exhaustion denial of service in Apache Thrift's Java TSaslNonblockingServer component allows remote attackers to drive the service into an unresponsive state by consuming server resources without limit (CWE-770). All Apache Thrift releases before 0.25.0 are affected, and the CVSS:4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) confirms the attack is network-reachable and requires no credentials or user interaction once an exposed TSaslNonblockingServer endpoint is reachable; impact is confined to availability, with no confidentiality or integrity loss. Exploitation is only possible against deployments that specifically use the Java non-blocking SASL server class, which limits real-world exposure since blocking servers and non-SASL configurations are unaffected; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this is a patch-now hygiene item rather than an emergency.
Denial of service in the Erlang language bindings of Apache Thrift before 0.25.0 allows remote attackers to exhaust server resources through unbounded allocation, degrading or crashing the affected service. The flaw is CWE-770 (Allocation of Resources Without Limits or Throttling) and carries a CVSS v4.0 base score of 8.2; our independent assessment scores it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, reflecting a high-availability-only impact that requires a specific crafted message structure (AT:P) rather than arbitrary traffic. Only deployments running a Thrift server compiled with the Erlang bindings and exposed to attacker-reachable network traffic are affected; users of the C++, Java, Python, Go and other bindings are not impacted, and no public exploit code was identified at time of analysis.
An uncaught exception (CWE-248) in Apache Thrift's PHP language bindings before 0.25.0 allows unauthenticated remote attackers to terminate PHP processes that accept arbitrary Thrift protocol input, producing a denial of service with no confidentiality or integrity impact. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) means no privileges or user interaction are required against a default deployment that exposes a vulnerable PHP-based Thrift endpoint to untrusted network traffic; the practical prerequisite is that the target actually uses the PHP bindings rather than another language binding. No public exploit code and no confirmed active exploitation were identified at time of analysis, and exploitation potential is bounded to service availability - this is a genuine but limited availability risk rather than a data-breach emergency.
Denial of service in the Apache Thrift PHP bindings before 0.25.0 allows unauthenticated remote attackers who can reach a Thrift service built on those bindings to exhaust server resources via unbounded allocation. The flaw is CWE-770 (allocation of resources without limits or throttling), triggered when the PHP binding processes attacker-controllable message sizes or collections without a cap; impact is limited to availability (VA:H; VC:N/VI:N), meaning no data disclosure or code execution. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), so risk is highest for externally reachable Thrift endpoints that accept untrusted clients. Vendor-released patch: 0.25.0.
Unbounded resource allocation in the Node.js bindings of Apache Thrift (all versions before 0.25.0) allows remote, unauthenticated attackers to exhaust memory and crash an exposed Thrift service by sending a crafted message whose declared quantity/size field is not validated before allocation. Impact is limited to availability: no confidentiality or integrity effect, and no code execution is achievable through this path. Exploitation requires a Node.js binding deployment that actually parses untrusted client input (the assessed AT:P condition), and because only the Node.js bindings below 0.25.0 are affected, deployments using other language bindings or newer versions are not exposed; there is no public exploit code identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV).
Uncontrolled recursion in Apache Thrift's c_glib (C/GLib) bindings causes stack exhaustion and process crash when a crafted, deeply nested message is deserialized from an untrusted source. Only applications built against the c_glib bindings at versions before 0.25.0 are affected; deployments using the Java, Python, C++ or other language bindings are not impacted by this specific issue. The flaw is availability-only - no confidentiality or integrity loss - and is reachable over the network without authentication (CVSS:4.0 PR:N, AT:P), though exploitation depends on the recursive parsing path being exposed to attacker-controlled input; no public exploit code or confirmed active exploitation was identified at time of analysis.
Repeated, attacker-triggered exceptional conditions in the Apache Thrift Java bindings can leak server-side resources and degrade or exhaust a Thrift RPC service running any version before 0.25.0. The issue is remotely reachable without authentication (CVSS PR:N) and needs no user interaction, but the assessed impact is availability only - there is no confirmed confidentiality or integrity effect, so this is a denial-of-service exposure rather than a data-compromise issue. A CVSS 4.0 attack-requirement flag (AT:P) indicates a specific precondition must be met to drive the vulnerable error path, meaning not every request triggers the leak; the precise condition is not specified in the public advisory text, and no public exploit identified at time of analysis. Deployments not using the Java bindings, or already on 0.25.0 or later, are unaffected.
Uncontrolled recursion in the Dart and Java ME bindings of Apache Thrift before 0.25.0 lets a remote, unauthenticated attacker crash or hang a service by sending a Thrift message containing deeply nested or self-referential structures that exhaust the parser's stack. Impact is availability-only (no confidentiality or integrity effect per the assessed CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and the vulnerable surface is confined to deployments that deserialize untrusted data using the Dart or Java ME bindings, so most Thrift users on Java SE, C++, Python, or Go are not exposed. No public exploit code or confirmed active exploitation was identified at time of analysis; the CVSS 4.0 base score of 8.7 should be read alongside the narrow binding-specific exposure, which makes real-world priority moderate rather than critical.