Apache Security Advisory
Apache Syncope 4.0.9 and 4.1.4 Fix Authorization and Code-Execution FlawsNew!!
Apache publishes security fixes. Match the affected branch and feature use, deploy the supported version, validate operations, and retain change evidence.
Apache Arrow Rust Fixes RunEndEncoded Array Out-of-Bounds ReadsNew!!
Apache publishes security fixes. Match the affected branch and feature use, deploy the supported version, validate operations, and retain change evidence.
Apache Wicket Fixes Authorization, Session, Upload, and XSS FlawsNew!!
Apache Wicket fixes authorization, session, upload, and XSS flaws. Match components and versions, upgrade the affected branch, and test access controls.
Apache Camel 4.22.2 Fixes A2A Webhook SSRF
Apache Camel 4.22.2 fixes blind SSRF in A2A push webhooks. Confirm untrusted registration paths, update, restrict egress, and retain evidence.
Apache Qpid Proton C 0.41.1 Fixes Four Security Flaws
Apache Qpid Proton C 0.41.1 fixes four AMQP, SASL, TLS, and parser flaws. Inventory linked applications, update, validate, and retain evidence.
Apache Kafka October Update Fixes Twelve Vulnerabilities
Apache Kafka fixes twelve broker, OAuth, Connect, Streams, and client flaws. Match CVE ranges, update supported branches, validate, and retain evidence.
Apache DataSketches C++ 5.3.0 Hardens Five Deserialization Paths
Apache DataSketches C++ 5.3.0 fixes five deserialization flaws. Find untrusted sketch inputs, upgrade, validate consumers, and retain evidence.
Apache HTTP Server 2.4.69 Fixes Twenty Vulnerabilities
Apache HTTP Server 2.4.69 fixes twenty module- and configuration-dependent flaws. Inventory enabled CGI, WebDAV, HTTP/2, proxy and authentication paths, then use upstream or distribution fixes; a distribution's base version alone is not a patch verdict.
Apache Tomcat Native Updates Address Three TLS Flaws
Tomcat Native updates fix handshake crashes, insecure TLS defaults and a client-certificate race. Verify the native library loaded by each JVM; updating Tomcat Java files or system OpenSSL alone does not establish remediation.
Apache Tomcat Updates Address Twelve Security Flaws
Tomcat updates address certificate checks, shared authentication, WebSocket controls and HTTP/AJP resource handling. Update the matching supported branch, including embedded runtimes through their vendor, and migrate unsupported releases rather than assuming their final builds are fixed.