Apache Projects Hit by 25 Vulnerabilities: Fory, CXF, APR-util, Answer, Polaris Affected
Apache projects Apache Fory, APR-util, CXF, Answer, and Polaris were impacted by a batch of 25 vulnerabilities disclosed August 5-7, 2026, with severities up to Critical (9.8 CVSS).
Key findings
- 25 vulnerabilities disclosed across Apache Fory, APR-util, CXF, Answer, and Polaris between August 5-7, 2026.
- Critical flaws include out-of-bounds reads, heap type confusion, SQL injection, and deserialization vulnerabilities.
- Apache CXF affected by multiple OAuth/OIDC flaws enabling auth bypass and repeated token redemption.
- Apache Answer has critical and high-severity issues including insufficient session expiration and information exposure.
- Patches are available for most affected versions, with users urged to upgrade promptly.
On August 6, 2026, a significant batch of 25 vulnerabilities was disclosed across multiple Apache projects, including Apache Fory, Apache Portable Runtime Utility (APR-util), Apache CXF, Apache Polaris, and Apache Answer. The vulnerabilities, disclosed between August 5th and August 7th, span a range of severities, with several critical flaws carrying CVSS scores up to 9.8. These issues primarily involve deserialization vulnerabilities, heap-based buffer overflows, SQL injection, and authorization bypasses, posing a substantial risk to users of these widely deployed Apache software components.
Several critical vulnerabilities were identified in Apache Fory, a C++ and Go implementation. CVE-2026-71560, a critical out-of-bounds read in C++ deserialization, and CVE-2026-71558, a critical heap type confusion in C++ deserialization, affect versions prior to 1.5.0. Additionally, CVE-2026-71559, a high-severity denial-of-service vulnerability due to deserialization of untrusted data in the Go implementation, also impacts versions prior to 1.5.0.
Apache Portable Runtime Utility (APR-util) is affected by multiple high and critical severity issues. CVE-2026-34502 and CVE-2026-34501 detail heap-based buffer overflows in the memcached and redis clients, respectively, affecting versions up to 1.6.3. A critical SQL injection vulnerability, CVE-2026-34191, exists in the apr_dbd_oracle provider for versions 1.6.0 through 1.6.3. Furthermore, CVE-2026-32327 highlights a stack recursion vulnerability in the apr_xml_quote_elem() function, and CVE-2025-49506 points to a timing side-channel vulnerability in apr_password_validate().
Apache CXF experienced a cluster of critical and high-severity vulnerabilities related to its OAuth and OpenID Connect implementations, as well as transport and message handling. CVE-2026-68079 and CVE-2026-57818 describe flaws allowing repeated redemption of authorization codes, while CVE-2026-68481 indicates that revoked access tokens could still be successfully decrypted. CVE-2026-65583 allows authentication bypass via crafted self-issued ID tokens, and CVE-2026-61466 enables clients to self-assign privileged scopes. CVE-2026-66909, a critical deserialization vulnerability in the JMS transport, and CVE-2026-64958, an incomplete fix for a DoS vulnerability related to attachment headers, are also notable. CVE-2026-57817 and CVE-2026-54225 address issues with authorization code validation and attachment size limits, respectively, which could lead to DoS or authorization code substitution. CVE-2026-65432 involves improper handling of external entities in WSDL imports.
Apache Answer, a Q&A platform, has three vulnerabilities disclosed, all affecting versions up to 2.0.1. CVE-2026-60053, a critical insufficient session expiration flaw, allowed administrative API keys to remain active after user demotion or account deactivation. CVE-2026-60023, a high-severity information exposure vulnerability, permitted unauthorized users to retrieve deleted or pending answers. CVE-2026-50749, a medium-severity improper authorization flaw, allowed any authenticated user to reject edit-revisions without proper permissions. CVE-2026-48912, another medium-severity improper input validation issue, allowed any authenticated user to delete other users' avatars.
Apache Polaris has one medium-severity vulnerability, CVE-2026-64640, where inconsistent validation of storage locations during table and view registration could lead to unauthorized reading of caller-selected data.
The majority of these vulnerabilities have been addressed in newer versions. For Apache Fory, users should upgrade to 1.5.0. APR-util users should upgrade to 1.6.4 for CVE-2026-32327 and CVE-2025-49506, and to version 1.6.4 for CVE-2026-34502 and CVE-2026-34501. Apache CXF users should upgrade to versions 4.2.3, 4.1.8, or 3.6.12 for several of the disclosed issues. Apache Answer users should upgrade to version 2.0.2 to remediate the vulnerabilities. Users of Apache Polaris should consult specific advisories for mitigation.
This extensive batch of vulnerabilities underscores the importance of timely patching and diligent security practices across the Apache ecosystem. The diverse nature of the flaws, ranging from deserialization exploits to authorization bypasses and denial-of-service vectors, highlights the need for continuous vigilance and prompt application of security updates to protect against potential exploitation. Users are strongly advised to review the specific CVE details and apply the recommended updates to their Apache software deployments.