Loading story…
An OWASP Dependency-Check review found 25 outdated Apache Drill 1.16.0 dependencies with known vulnerabilities after false positives were excluded. The reported exposures included jackson-databind 2.9.5, affected by critical CVE-2018-14721 (CVSS 10.0), and Derby 10.10.2.0, affected by CVE-2015-1832 (CVSS 9.1), alongside issues involving Kafka, Kudu/protobuf, and other libraries. The findings identify vulnerable component versions but do not establish exploitability, active exploitation, or compromise of Drill deployments.
Apache created DRILL-7416 to coordinate upgrades, replacements, and releases needed to remediate the dependencies. Proposed actions included updating direct third-party libraries and Drill-shaded components; some fixes required upstream or release-level work for shaded Guava, jQuery, Bootstrap, and Kudu's Netty dependency. Updating kudu-client to 1.10.0 was identified as only a partial mitigation because the associated Netty dependency would remain affected by CVE-2019-16869.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Bradley Parker created DRILL-7416 for Apache Drill 1.16.0 after a review identified 25 dependencies requiring updates after false positives were excluded. The issue proposed upgrades or replacements for affected components, while noting that some fixes required new Drill releases or an upstream Netty update for Kudu.
Bradley Parker of IBM's product-security team reported that an OWASP Dependency-Check scan found 24 Apache Drill dependencies with known CVEs, including Jackson Databind 2.9.5 and Derby 10.10.2.0. Apache Drill committer Charles Givre asked him to open a JIRA issue to begin discussion of the findings.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
lists.apache.org
Open sourcelists.apache.org
Open sourceissues.apache.org
Open sourcelists.apache.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Apache Software Foundation reported handling **376 new vulnerability reports** across **101** top-level projects in 2020, closing 341 cases and assigning **151 CVEs** while adopting new tooling and the CVE automation API to speed disclosure. The report highlighted several high-profile issues, including the Apache Struts flaw tracked as `CVE-2019-0230`, where forced double OGNL evaluation in tag attributes can lead to **remote code execution** in Struts `2.0.0` through `2.5.20`, alongside other notable Apache security events that drew public exploit or proof-of-concept attention. Additional disclosures tied to that period included two Apache Flink directory traversal bugs, `CVE-2020-17518` and `CVE-2020-17519`, affecting exposed REST APIs and enabling arbitrary file write or read access on vulnerable JobManager hosts; Apache said users should upgrade to **Flink 1.11.3 or 1.12.0**. Apache also published `CVE-2020-13951`, a denial-of-service issue in the public NetTest web service of Apache OpenMeetings `4.0.0` through `5.0.0`, and `CVE-2019-0235`, a **CSRF** flaw in Apache OFBiz `17.12.01`, underscoring the breadth of web, file-system, and application-layer risks disclosed across Apache projects.
Aug 15, 2026
Apache disclosed **CVE-2026-34191**, an important-severity SQL injection vulnerability in **Apache Portable Runtime Utility (APR-util)** affecting versions `1.6.0` through `1.6.3`. The flaw is located in the `apr_dbd_oracle` provider, exposing applications that rely on that component for Oracle database interactions to SQL injection risk. The issue was reported by **Elhanan Haenel** on `2026-03-24` and fixed in the `1.6.x` branch on `2026-08-06` with revision `r1936817`, according to Apache advisories published through the Apache mailing lists and mirrored on oss-security and Openwall. Organizations using APR-util with the Oracle DBD provider should identify affected deployments and update to a release containing the fix.
Aug 7, 2026
Apache released Tomcat **11.0.25**, **10.1.58**, and **9.0.121** to remediate 11 vulnerabilities across supported release lines. The most consequential issues include `CVE-2026-68569`, where DataSourceRealm principal lookup can fail open with mechanisms such as CLIENT-CERT or SPNEGO; `CVE-2026-65182`, which can bypass security constraints based on path-rule ordering; and `CVE-2026-65927`, an off-by-one RewriteValve error that may bypass access controls. `CVE-2026-68763` also permits denial of service through an HTTP/2 backlog-tracking allocation leak when streams are reset. The updates additionally address authorization bypasses involving FORM-authentication redirects (`CVE-2026-68525`) and `security-role-ref` aliases (`CVE-2026-66422`), a limited DIGEST-authentication replay condition (`CVE-2026-65905`), an HTTP/2 strict-SNI-validation bypass from an incomplete prior fix (`CVE-2026-65637`), a Unix-domain-socket permission race (`CVE-2026-65183`), and WebSocket sessions that can survive expiration of their associated HTTP session (`CVE-2026-73180`). Organizations should prioritize upgrades, particularly for internet-facing deployments; Tomcat 7 and 8.5 installations are end of life and should be retired or otherwise remediated. No confirmed in-the-wild exploitation or public proof-of-concept code was reported.
Aug 31, 2026