#Apache
All CosmicBytez Labs articles tagged #Apache, across news, security advisories, how-to guides, and projects.
- Security
Unauthenticated Denial-of-Service in Apache Qpid Broker-J ≤ 10.1.0
A pre-auth denial-of-service flaw (CVSS 7.5) in Apache Qpid Broker-J lets attackers crash the AMQP broker via malformed frame headers.
- Security
Apache HttpComponents TLS Hostname Verification Bypass
Apache HttpComponents Client 5.4+ async mode ignores HostnameVerificationPolicy#BUILTIN, enabling MITM attacks against TLS connections in affected applications.
- News
AI-Assisted HTTP Terminator Finds Novel Desync Techniques and Apache Zero-Day
PortSwigger researcher James Kettle unveiled HTTP Terminator at Black Hat USA 2026 — an autonomous AI system that invented three new HTTP request...
- Security
CVE-2026-58155: Apache Traffic Server Header Truncation Enables Request Smuggling and Policy Bypass
A critical vulnerability in Apache Traffic Server allows attackers to exploit over-long header name truncation to alias headers, smuggle HTTP requests,...
- Security
CVE-2026-64606: Apache Fury Critical Deserialization Flaw (CVSS 9.8)
A critical deserialization vulnerability in Apache Fury allows attackers to bypass class-registration checks during Java lambda deserialization, enabling...
- Security
CVE-2026-59084: Apache Tomcat EncryptInterceptor Misconfiguration Risk (CVSS 9.1)
Apache Tomcat's EncryptInterceptor cluster encryption feature has been insufficiently documented since version 9.0.13, leaving deployments vulnerable to...
- Security
CVE-2025-55017: Apache IoTDB Critical Path Traversal Vulnerability
Critical path traversal vulnerability (CVSS 9.1) in Apache IoTDB affects versions 1.0.0 through 1.3.5 and 2.0.0 through 2.0.5. Users must upgrade...
- Security
CVE-2025-64152: Apache IoTDB Second Critical Path Traversal Flaw
A second critical path traversal vulnerability (CVSS 9.1) in Apache IoTDB affects versions 1.0.0 through 1.3.5 and 2.0.0 through 2.0.6. Patch to 1.3.6 or...
- News
Critical Apache HTTP/2 Flaw (CVE-2026-23918) Enables DoS
The Apache Software Foundation has released urgent security updates for the Apache HTTP Server addressing a severe vulnerability in the HTTP/2 protocol...