FAIL › dossier
apache
VENDOR· dossier confidence 20%
Apache is a foundational open-source software provider whose portfolio is plagued by a chronic pattern of critical remote code execution vulnerabilities, particularly in its web server and data processing components.
PROFILE
Categoryopen-source software vendorWhat they doApache is a non-profit organization that develops and maintains a wide range of open-source software projects, including web servers, databases, and big data frameworks.
Websitehttps://www.apache.org ↗
SECURITY POSTURE
Apache's security posture is severely compromised by a relentless history of critical and high-severity remote code execution (RCE) vulnerabilities across its core projects, indicating systemic weaknesses in input validation, deserialization, and access control implementations.
Notable failures
- CVE-2021-44228 Log4j2 RCE
- CVE-2023-46604 ActiveMQ RCE
- CVE-2021-42013 HTTP Server RCE
- CVE-2021-41773 HTTP Server RCE
- CVE-2021-45046 Log4j2 RCE
- CVE-2021-40438 HTTP Server RCE
Patterns: repeated unpatched deserialization RCEs; path traversal leading to RCE; improper access control in core components; vulnerabilities in widely deployed web server and data processing frameworks
FAILURE HISTORY · 60
| DATE | EVENT | SEV | SUMMARY |
|---|---|---|---|
| 2022-03-25 | CVE-2017-12615 | critical | Apache Tomcat on Windows allowed arbitrary code execution via uploaded JSP files when HTTP PUT was enabled. |
| 2021-12-10 | CVE-2021-44228 | critical | The Log4j2 vulnerability allowed attackers to execute arbitrary code on vulnerable systems remotely. |
| 2024-08-27 | CVE-2024-38856 | high | Apache OFBiz allows unauthenticated remote code execution via Groovy deserialization, enabling attackers to compromise ERP systems. |
| 2024-08-07 | CVE-2024-32113 | high | Apache OFBiz allows remote code execution via path traversal in authenticated report scenarios. |
| 2023-11-02 | CVE-2023-46604 | critical | A remote attacker could execute arbitrary shell commands on an Apache ActiveMQ broker by exploiting a deserialization vulnerability in the OpenWire protocol. |
| 2023-05-01 | CVE-2021-45046 | critical | Apache Log4j2's incomplete fix for CVE-2021-44228 left the Thread Context Lookup Pattern vulnerable to remote code execution in non-default configurations. |
| 2022-03-25 | CVE-2020-1956 | high | Apache Kylin OS had an unpatched command injection flaw allowing remote code execution. |
| 2026-08-04 | CVE-2026-34486 | high | Apache Tomcat missing encryption of sensitive data allows bypass of EncryptInterceptor. |
| 2025-05-01 | CVE-2024-38475 | high | Apache HTTP Server's mod_rewrite module has a vulnerability allowing attackers to potentially execute code or disclose source code via improper output escaping, and is currently being actively exploited in the wild. |
| 2023-09-06 | CVE-2023-33246 | high | Apache RocketMQ's exposed components lacked permission checks, allowing command execution via configuration updates or forged protocol content, and is currently being exploited in the wild. |
| 2023-05-12 | CVE-2016-8735 | high | Apache Tomcat remote code execution vulnerability exposed |
| 2023-03-07 | CVE-2022-33891 | high | Apache Spark exposed to command injection via UI with ACLs enabled, actively exploited in wild |
| 2022-08-25 | CVE-2022-24112 | high | Apache APISIX RCE due to auth bypass actively exploited in wild |
| 2022-08-25 | CVE-2022-24706 | high | Apache CouchDB default initialization flaw allows admin privilege escalation |
| 2021-11-03 | CVE-2017-5638 | critical | Apache Struts' file upload parser allowed attackers to execute arbitrary code remotely, actively exploited and linked to ransomware attacks. |
| 2021-11-03 | CVE-2021-42013 | critical | An incomplete Apache HTTP Server patch left systems vulnerable to remote code execution via path traversal, actively exploited in ransomware attacks and impacting NIST 800-171 compliance efforts. |
| 2021-11-03 | CVE-2021-41773 | critical | Apache HTTP Server's path traversal vulnerability allowed remote code execution, and the initial patch was inadequate, demonstrating a failure to properly secure web server configurations and remediate vulnerabilities effectively. |
| 2026-04-16 | CVE-2026-34197 | high | Apache ActiveMQ exploited a code injection vulnerability (CVE-2026-34197) allowing remote code execution. |
| 2025-04-01 | CVE-2025-24813 | high | Apache Tomcat's path equivalence vulnerability allows remote code execution via partial PUT requests, currently being actively exploited in the wild. |
| 2024-09-18 | CVE-2024-27348 | high | Apache HugeGraph-Server allows remote arbitrary code execution via improper access control, enabling attackers to compromise graph databases used by defense systems. |
| 2024-01-08 | CVE-2023-27524 | high | Apache Superset shipped with a default SECRET_KEY that allows attackers to authenticate and access unauthorized resources without changing configuration. |
| 2022-03-25 | CVE-2013-2251 | high | Apache Struts allows remote attackers to execute arbitrary Object-Graph Navigation Language (OGNL) expressions. |
| 2022-03-25 | CVE-2017-12617 | high | When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server. |
| 2022-02-10 | CVE-2016-3088 | high | The Fileserver web application in Apache ActiveMQ allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request |
| 2022-02-10 | CVE-2017-9791 | high | The Struts 1 plugin in Apache Struts might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage. |
| 2022-01-21 | CVE-2012-0391 | high | The ExceptionDelegator component in Apache Struts 2 before 2.2.3.1 contains an improper input validation vulnerability that allows for remote code execution. |
| 2022-01-18 | CVE-2020-11978 | high | A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow. |
| 2021-12-10 | CVE-2019-0193 | high | The optional Apache Solr module DataImportHandler contains a code injection vulnerability. |
| 2021-11-03 | CVE-2017-9805 | high | Apache Struts REST Plugin uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to remote code execution when deserializing XML payloads. |
| 2021-11-03 | CVE-2018-11776 | high | Apache Struts contains a vulnerability that allows for remote code execution under two circumstances. One, where the alwaysSelectFullNamespace option is true and the value isn't set for a result defined in underlying configurations and in same time, its upper package configuratio |
| 2021-11-03 | CVE-2020-17530 | high | Forced Object-Graph Navigation Language (OGNL) evaluation in Apache Struts, when evaluated on raw user input in tag attributes, can lead to remote code execution. |
| 2021-11-03 | CVE-2019-17558 | high | The Apache Solr VelocityResponseWriter plug-in contains an unspecified vulnerability which can allow for remote code execution. |
| 2021-11-03 | CVE-2016-4437 | high | Apache Shiro contains a vulnerability which may allow remote attackers to execute code or bypass intended access restrictions via an unspecified request parameter when a cipher key has not been configured for the "remember me" feature. |
| 2022-03-03 | CVE-2020-1938 | high | Apache Tomcat treats Apache JServ Protocol (AJP) connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited. |
| 2022-01-21 | CVE-2006-1547 | high | ActionForm in Apache Struts versions before 1.2.9 with BeanUtils 1.7 contains a vulnerability that allows for denial-of-service (DoS). |
| 2022-01-18 | CVE-2020-13927 | high | The previous default setting for Airflow's Experimental API was to allow all API requests without authentication. |
| 2021-12-01 | CVE-2021-40438 | high | A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier. |
| 2021-12-01 | CVE-2021-40438 | high | A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier. |
| 2021-11-03 | CVE-2019-0211 | high | Apache HTTP Server, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute code with the privileges of the parent process (usually root) by manipulating the |
| 2025-02-04 | CVE-2024-45195 | high | Apache OFBiz allows remote attackers to bypass forced browsing restrictions and access unauthorized data via SQL injection. |
| 2024-05-23 | CVE-2020-17519 | high | Apache Flink's REST interface allows attackers to read any file on the JobManager's local filesystem due to improper access control. |
| 2026-07-03 | CVE-2026-47898 | critical | Improper Restriction of XML External Entity Reference vulnerability in Apache Lucene.Net (Lucene.Net.Analysis.Common library). This issue affects Apache Lucene.Net.Analysis.Common: from 4.8.0-beta00005 before 4.8.0-beta00018. Users are recommended to upgrade to version 4.8.0-be |
| 2026-06-12 | CVE-2026-49875 | critical | Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7, which fix t |
| 2026-06-12 | CVE-2026-50628 | critical | A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this security feature inadvertently creates an inverse security check. Users are recommended to upgrade to v |
| 2026-06-12 | CVE-2026-50627 | critical | The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a completely different Resource Server, leading to Token Confusion/Rou |
| 2026-05-22 | CVE-2026-44930 | critical | An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue. |
| 2024-06-12 | CVE-2024-36265 | critical | ** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Submarine Server Core. This issue affects Apache Submarine Server Core: from 0.8.0. An attacker can bypass authentication by sending specially crafted REST requests. As this project is retired, we |
| 2026-08-03 | CVE-2026-68979 | critical | CVE-2026-68979: Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API me |
| 2026-08-03 | CVE-2026-68980 | critical | CVE-2026-68980: Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets |
| 2026-07-30 | CVE-2026-66756 | critical | CVE-2026-66756: Improper Protection of Alternate Path vulnerability in Apache Tika. This issue |
| 2026-07-29 | CVE-2026-33267 | critical | CVE-2026-33267: Improper Input Validation vulnerability in Apache Traffic Server. This issue af |
| 2026-07-29 | CVE-2026-58163 | high | CVE-2026-58163: Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corr |
| 2026-07-29 | CVE-2026-58179 | high | CVE-2026-58179: The Apache Traffic Server regex_remap plugin overflows the stack and integers fr |
| 2026-07-29 | CVE-2026-58177 | high | CVE-2026-58177: The Apache Traffic Server Cripts framework has out-of-bounds writes, path traver |
| 2026-07-29 | CVE-2026-58185 | medium | CVE-2026-58185: The Apache Traffic Server intercept plugin has a use-after-free. This issue aff |
| 2026-07-27 | CVE-2026-48144 | critical | CVE-2026-48144: Improper Validation of Certificate with Host Mismatch vulnerability in Apache Th |
| 2026-07-27 | CVE-2026-55971 | critical | CVE-2026-55971: Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This is |
| 2026-07-27 | CVE-2026-58023 | critical | CVE-2026-58023: Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings. This issue a |
| 2026-07-27 | CVE-2026-58662 | critical | CVE-2026-58662: Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerabi |
| 2026-07-14 | CVE-2026-62390 | critical | CVE-2026-62390: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti |
SENTIMENT · TRUSTED SOURCES
synthesissevere-fallout-0.60
Apache faced severe fallout due to an RCE vulnerability in Solr, though the provided sources lack specific press commentary or authority condemnation, only technical CVE listings and vendor PSIRT page
synthesissevere-fallout-0.60
Apache HTTP Server's incomplete patch for CVE-2021-41773 led to a new path traversal vulnerability allowing remote code execution, indicating a failure in timely and complete remediation.
synthesissevere-fallout-0.60
Apache HTTP Server path traversal vulnerability allowing remote code execution is a severe security flaw, with the original patch deemed insufficient, indicating a significant failure in vendor respon
synthesissevere-fallout-0.60
Apache Struts RCE vulnerability widely recognized as critical, though provided sources lack direct commentary on vendor response or press reception.
synthesissevere-fallout-0.60
Apache faced severe fallout due to a critical RCE vulnerability in Struts, widely condemned for lack of type filtering in XML deserialization.
synthesisneutral+0.00
No security press or authority coverage found for CVE-2020-17530 in the provided sources; sources are unrelated or empty.
synthesisneutral+0.00
No sentiment expressed; sources are CVE databases with no commentary on Apache's handling.
synthesissevere-fallout-0.60
Apache's CVE-2019-0211 was a critical privilege escalation flaw allowing root code execution via scoreboard manipulation, widely recognized as a severe vulnerability in the Apache HTTP Server.
synthesissevere-fallout-0.60
Apache faced severe fallout due to a critical RCE vulnerability in Struts, widely condemned by security press and authorities for allowing malicious file uploads via Content-Type, leading to remote co
synthesissevere-fallout-0.80
Apache's handling of CVE-2021-40438 was criticized for delayed disclosure and lack of immediate patching, leading to widespread exploitation and reputational damage.
Neutral; page displays NVD redirect warning and unrelated CVE-2026-56164, no sentiment toward Apache.
Neutral; CVE Find database lists CVEs without specific sentiment toward Apache for CVE-2017-5638.
Neutral; OpenCVE search results show unrelated CVEs, no sentiment toward Apache.
Severe condemnation for critical RCE flaw in Struts Jakarta Multipart parser enabling malicious file uploads via Content-Type.
"Apache Struts Jakarta Multipart parser allows for malicious file upload using the Content-Type value, leading to remote code execution."
Neutral real-time CVE database with no specific vendor sentiment.
"Latest Cybersecurity Vulnerabilities | Real-Time CVE Database"
Neutral listing of CVEs without specific commentary on Apache's handling.
"Apache CVEs and Security Vulnerabilities - OpenCVE"
No relevant content; generic CVE database landing page.
No relevant content; page is a generic NVD redirect/landing page.
Critical RCE flaw in Apache Struts, but source is a neutral NVD database entry without commentary on vendor handling.
"Apache Struts contains a vulnerability that allows for remote code execution under two circumstances."
Apache HTTP Server's incomplete patch for CVE-2021-41773 led to a new path traversal vulnerability allowing remote code execution, indicating a failure in timely and complete remediation.
"Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if files outside directories configured by Alias-like directives are not under default require all denied or if CGI scripts are enabled. This CVE ID resolves an incomplete patch for CVE-2021-41773."
No relevant content; generic FortiGuard PSIRT landing page.
No relevant content; generic OpenCVE landing page.
No relevant content; generic SentinelOne landing page.
No relevant content; generic SAM.gov landing page.
Irrelevant coverage of unrelated vendor TruStage.
"TruStage shuts down network following cybersecurity incident"
Severe vulnerability disclosed, no praise.
"The Apache Solr VelocityResponseWriter plug-in contains an unspecified vulnerability which can allow for remote code execution."
Neutral CVE listing, no commentary.
Neutral CVE database, no commentary.
Neutral; GitHub cisagov/kev-data mirror unrelated to Apache or CVE-2017-5638.
DOSSIER SOURCES
- APA Corp (US) (APA) Company Profile, History, Products & Services · www.financecharts.com
- Company Overview - APA - NASDAQ - Weiss Ratings · weissratings.com
- APA Stock Price Quote | Morningstar · www.morningstar.com
- CVEs and Security Vulnerabilities - OpenCVE · app.opencve.io
- Critical CVE 48-Hour Emergency Patch Playbook 2026 · www.decryptiondigest.com
- Latest Cybersecurity Vulnerabilities | Real-Time CVE Database · cve.akaoma.com
Open questions: Apache's current patch response time for critical RCE vulnerabilities · The extent of Apache's internal security review processes for new projects
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-07-15 04:03:03.962108+00:00