This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Apache fixes 12 vulnerabilities in various products
Apache fixes 12 vulnerabilities in various products [1]. The most severe of them can be found below. Products and their fixed versions: Apache Tomcat - 11.0.21, 10.1.54, 9.0.117 [2][3][4][5][6][7][8][9][10][11] Apache Tomcat Native - 1.3.7, 2.0.14 [8] Apache Airflow - 3.2.0 [12][13]
An unauthenticated remote attacker is able to bypass authentication due to a flaw in client certificate validation, which may lead to unauthorized access to sensitive data and its subsequent modification [8].
The vulnerability is present in products:
- Apache Tomcat; >=11.0.0-M1, <11.0.20; >=10.1.0-M7, <10.1.53; >=9.0.83, <9.0.116
- Apache Tomcat Native; >=1.1.23, <=1.1.34; >=1.2.0, <=1.2.39; >=1.3.0, <1.3.7, >=2.0.0, <2.0.14
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
More information:
- CVE-2026-29145 at cve.org, NVD
- CWE-287: Improper Authentication at cwe.mitre.org
The vulnerability was publicly disclosed 9. 4. 2026.
An unauthenticated remote attacker is able to access a Kubernetes bearer token due to improper logging of data to log files, which may lead to disclosure of sensitive data [3].
The vulnerability is present in product:
- Apache Tomcat; >=11.0.0-M1, <11.0.21; >=10.1.0-M1, <10.1.54; >=9.0.13, <9.0.117
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
More information:
- CVE-2026-34487 at cve.org, NVD
- CWE-532: Insertion of Sensitive Information into Log File at cwe.mitre.org
The vulnerability was publicly disclosed 9. 4. 2026.
An unauthenticated remote attacker is able to carry out an HTTP request smuggling attack due to inconsistent interpretation of invalid extensions in chunked encoding [11].
The vulnerability is present in product:
- Apache Tomcat; >=7.0.0, <=7.0.109; >=8.5.0, <=8.5.100; >=9.0.0.M1, <9.0.116; >=10.1.0-M1, <10.1.52; >=11.0.0-M1, <11.0.20
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
More information:
- CVE-2026-24880 at cve.org, NVD
- CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') at cwe.mitre.org
The vulnerability was publicly disclosed 9. 4. 2026.
An unauthenticated remote attacker is able to take control of a user's session due to insufficient expiration of the JWT token after logout [12].
The vulnerability is present in product:
- Apache Airflow; >=3.0.0, <3.2.0
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
More information:
- CVE-2025-57735 at cve.org, NVD
- CWE-613: Insufficient Session Expiration at cwe.mitre.org
The vulnerability was publicly disclosed 9. 4. 2026.
Links
- [1] https://www.openwall.com/lists/oss-security/2026/04/09/
- [2] https://www.openwall.com/lists/oss-security/2026/04/09/29
- [3] https://www.openwall.com/lists/oss-security/2026/04/09/28
- [4] https://www.openwall.com/lists/oss-security/2026/04/09/27
- [5] https://www.openwall.com/lists/oss-security/2026/04/09/26
- [6] https://www.openwall.com/lists/oss-security/2026/04/09/25
- [7] https://www.openwall.com/lists/oss-security/2026/04/09/24
- [8] https://www.openwall.com/lists/oss-security/2026/04/09/23
- [9] https://www.openwall.com/lists/oss-security/2026/04/09/22
- [10] https://www.openwall.com/lists/oss-security/2026/04/09/21
- [11] https://www.openwall.com/lists/oss-security/2026/04/09/20
- [12] https://www.openwall.com/lists/oss-security/2026/04/09/16
- [13] https://www.openwall.com/lists/oss-security/2026/04/09/9
By CESNET, z.s.p.o. Henrieta Paločková on 13. 4. 2026.