Read the docs

Apache

Records4054All Threatist records
Exploited (KEV)47In CISA KEV
CVSS critical776CVSS 9.0–10.0
CVSS high1543CVSS 7.0–8.9

Exploited now

Apache records in CISA KEV
TI-2026-79288 Google Brotli Unchecked Return Value Vulnerability Priority CRITICAL 99KEV 2026-10-27TI-2016-02580 Apache Struts Command Injection Vulnerability Priority CRITICAL 94KEV 2026-10-08TI-2026-26741 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability Priority CRITICAL 90KEV 2026-08-04TI-2026-26494 Apache ActiveMQ Improper Input Validation Vulnerability Priority CRITICAL 97KEV 2026-04-16TI-2024-25716 Apache HTTP Server Improper Escaping of Output Vulnerability Priority CRITICAL 98KEV 2025-05-01TI-2025-18529 Apache Tomcat Path Equivalence Vulnerability Priority CRITICAL 100KEV 2025-04-01

Components

Products in the NVD configurations · select one to filter the records
Http Server 350 records CRITICAL Tomcat 274 records CRITICAL Airflow 158 records CRITICAL Traffic Server 121 records CRITICAL Camel 117 records HIGH Struts 99 records CRITICAL Cxf 80 records MEDIUM Ofbiz 76 records CRITICAL

Records

8 records in Mina · all components

TI-2024-34922 CVE-2024-52046 · GHSA-76h9-2vwh-w278

Apache MINA: MINA applications using unbounded deserialization may allow RCE

Priority HIGH 70

The ObjectSerializationDecoder in Apache MINA uses Java’s native deserialization protocol to process incoming serialized data but lacks the necessary security checks and defenses.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.24649 Published 2024-12-25 Partial fix · 2.2.4, 2.1.10 +1 CWE-502
TI-2026-31001 CVE-2026-42779 · GHSA-vf5j-865m-mq7c

Deserialization of untrusted data in Apache MINA

Priority MEDIUM 51

The fix for CVE-2026-41635 was not applied to the 2.1.X and 2.2.X branches.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01228 Published 2026-05-01 Partial fix · 2.1.12, 2.2.7 CWE-502
TI-2026-30156 CVE-2026-41635 · GHSA-8297-v2rf-2p32

Deserialization of untrusted data in Apache MINA

Priority MEDIUM 50

Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the class at all, bypassing the classname allowlist and allowing arbitrary code to b…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00616 Published 2026-04-27 Partial fix · 2.0.28, 2.1.11 +1 CWE-502
TI-2026-30010 CVE-2026-41409 · GHSA-f2wh-grmh-r6jm

Apache MINA: CWE-502 Deserialization of Untrusted Data

Priority MEDIUM 49

The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00433 Published 2026-04-27 Partial fix · 2.0.28, 2.1.11 +1 CWE-502
TI-2019-00204 CVE-2019-0231 · GHSA-5h29-qq92-wj7f

Apache MINA SSLFilter security Issue

Priority LOW 37

Handling of the close_notify SSL/TLS message does not lead to a connection closure, leading the server to retain the socket opened and to have the client potentially receive clear text messages afterward.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02125 Published 2019-10-01 Partial fix · 2.0.21, 2.1.1 CWE-319
TI-2021-18513 CVE-2021-41973 · GHSA-6mcm-j9cj-3vc3

Apache MINA HTTP listener DOS

Priority LOW 36

In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.04634 Published 2021-11-01 Partial fix · 2.1.5, 2.0.22 CWE-835
Open these records in search →