AA
Product
Apache APISIX
On CISA KEVExploited in the wild
27
CVEs
1
On KEV
9.8
Max CVSS
7
New 30D
Severity mix
Critical 6High 10Medium 10Low 1
Watch
Add Apache APISIX to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-63041 | 8.8 | Aug 26 | Apache APISIX: attach-consumer-label does not strip client-supplied consumer-label headers Affected: 3.11.0 through 3.17.0 |
| CVE-2026-39998 | 8.8 | Jun 19 | Apache APISIX: Identity Injection via forward-auth Plugin Missing Header Cleanup Affected: 2.12.0 through 3.16.0 |
| CVE-2026-94250 | 8.2 | Oct 1 | Apache APISIX: Batch response aggregation can exhaust worker memory Affected: 1.3.0 through 3.18.0 |
| CVE-2026-75020 | 8.1 | Aug 27 | Apache APISIX: ldap-auth plugin cross-subtree identity impersonation Affected: 2.11.0 through 3.17.0 |
| CVE-2026-49872 | 8.1 | Jun 19 | Apache APISIX: Improper authentication in cas-auth plugin Affected: 3.0.0 through 3.16.0 |
| CVE-2026-47339 | 8.1 | Jun 19 | Apache APISIX: authz-casdoor incorrect session sharing Affected: 2.14.1 through 3.16.0 |
| CVE-2026-74848 | 7.5 | Aug 27 | Apache APISIX: Cross-user response poisoning in serverless plugins Affected: 2.12.0 through 3.17.0 |
| CVE-2026-75005 | 7.5 | Aug 27 | Apache APISIX: Unauthenticated CPU-exhaustion DoS Affected: 3.17.0 |
| CVE-2026-31923 | 7.5 | Apr 14 | Apache APISIX: Openid-connect `tls_verify` field is disabled by default Affected: 0.7 through 3.15.0 |
| CVE-2026-48895 | 7.2 | Jun 19 | Apache APISIX: Cas-auth Host header influence on CAS service URL Affected: 3.0.0 through 3.16.0 |
Showing 10