Apache Projects Hit by 25 Vulnerabilities in Coordinated August 2026 Disclosure
A batch of 25 vulnerabilities disclosed August 11-15, 2026, impacts multiple Apache projects including Struts, Allura, and Airflow, with severities ranging from Medium to Critical.
Key findings
- 25 CVEs disclosed across Apache Struts, Allura, Airflow, HttpComponents Client, and Shindig between Aug 11-15, 2026.
- Critical vulnerabilities include SSRF in Allura (CVE-2026-69223) and Git argument injection (CVE-2026-73240).
- Apache Airflow impacted by multiple deserialization and data exposure flaws (e.g., CVE-2026-67587, CVE-2026-68970).
- Apache Struts suffers from resource exhaustion and data exposure in its JSON plugin (e.g., CVE-2026-73635, CVE-2026-73632).
- Critical TLS hostname verification flaw in Apache HttpComponents Client's async version (CVE-2026-71290).
- Retired Apache Shindig has a deserialization vulnerability (CVE-2026-66256).
On August 11-15, 2026, a significant batch of 25 vulnerabilities was disclosed across multiple Apache projects, including Apache Struts, Apache Shindig, Apache Allura, Apache Airflow, and Apache HttpComponents Client. This coordinated disclosure event highlights a range of security weaknesses, from resource exhaustion and data exposure in Struts to deserialization flaws and SSRF in other components. The vulnerabilities carry severities ranging from Medium to Critical, with several critical flaws impacting Apache Allura and HttpComponents Client.
Several vulnerabilities in Apache Struts revolve around uncontrolled resource consumption and data exposure. CVE-2026-73635 and CVE-2026-73634, both disclosed on August 15th, detail resource allocation and consumption issues, respectively. These flaws could allow unauthenticated remote clients to exhaust server resources, leading to denial of service. Additionally, CVE-2026-73632 and CVE-2026-73631, also disclosed on the same day, expose data elements to the wrong sessions due to shared per-response or per-request parsing states in the JSON plugin. CVE-2026-73633, disclosed on August 14th, further exacerbates resource consumption risks within the JSON plugin when populating actions from a JSON request body.
Apache Allura is affected by multiple vulnerabilities, including a critical Server-Side Request Forgery (SSRF) flaw in its webhooks (CVE-2026-69223). This vulnerability, disclosed on August 11th, allows attackers to make unauthorized requests on behalf of the server. Additionally, CVE-2026-73240, a critical git argument injection vulnerability, was disclosed on August 12th, impacting versions prior to 1.19.1. Other issues in Allura include Insecure Direct Object Reference (IDOR) (CVE-2026-73239) and Cross-Site Scripting (XSS) vulnerabilities in code display (CVE-2026-73238) and Markdown handling (CVE-2026-73237). All these Allura-specific vulnerabilities are addressed in version 1.19.1.
Apache Airflow is impacted by a series of medium and high severity vulnerabilities disclosed on August 12th. These include issues related to deserialization of untrusted data (CVE-2026-67587, CVE-2026-58076), improper authorization in APIs (CVE-2026-68968, CVE-2026-68971), and exposure of sensitive information in logs and UI elements (CVE-2026-68970, CVE-2026-68969, CVE-2026-65017, CVE-2026-59244, CVE-2026-54183, CVE-2026-68868). CVE-2026-67260, a high-severity flaw, involves deserialization without an allow-list in human-in-the-loop tasks. The critical CVE-2026-71290, disclosed on August 11th, affects Apache HttpComponents Client 5.4 and newer, specifically its asynchronous version, by failing to properly verify TLS hostnames, enabling server impersonation.
Apache Shindig, a retired project, has a deserialization of untrusted data vulnerability (CVE-2026-66256) disclosed on August 13th, which could lead to arbitrary code execution. Due to the project's retired status, it will not receive further support.
The majority of these vulnerabilities have been addressed by the respective Apache projects. For Apache Allura, version 1.19.1 is recommended. Apache Airflow users should consult specific advisories for version updates, as multiple versions are affected. Apache Struts and HttpComponents Client also have patches available. Users are strongly advised to update to the latest versions to mitigate these risks. The wide range of affected projects and vulnerability types underscores the importance of diligent security practices across the Apache ecosystem.
The coordinated disclosure of these 25 CVEs across multiple Apache projects highlights a broad security challenge for users of these widely adopted technologies. The vulnerabilities span critical areas such as remote code execution, denial of service, and sensitive data exposure, necessitating prompt attention from administrators and developers. Staying informed about security advisories and applying patches promptly is crucial for maintaining the security posture of applications built on Apache software.
The vulnerabilities disclosed in Apache Struts (CVE-2026-73635, CVE-2026-73634, CVE-2026-73632, CVE-2026-73631, CVE-2026-73633) primarily concern resource exhaustion and data leakage due to improper handling of requests and internal states within the JSON plugin. These issues can be exploited by unauthenticated remote attackers to impact service availability and potentially expose sensitive information between concurrent user sessions.
Apache Allura faces critical threats including SSRF (CVE-2026-69223) and Git argument injection (CVE-2026-73240), alongside other vulnerabilities like IDOR and XSS (CVE-2026-73239, CVE-2026-73238, CVE-2026-73237). The SSRF vulnerability in webhooks is particularly concerning as it allows attackers to abuse the server's network access. All these issues are resolved in version 1.19.1.
Apache Airflow's vulnerabilities (CVE-2026-68971, CVE-2026-68970, CVE-2026-68969, CVE-2026-68968, CVE-2026-68076, CVE-2026-67587, CVE-2026-67260, CVE-2026-65017, CVE-2026-59244, CVE-2026-59242, CVE-2026-58076, CVE-2026-54183, CVE-2026-68868) predominantly stem from insecure deserialization practices, improper access controls, and insufficient masking of sensitive data in logs and UI. These flaws could lead to unauthorized code execution, privilege escalation, and exposure of secrets.
The critical CVE-2026-71290 in Apache HttpComponents Client highlights a fundamental security weakness in TLS hostname verification within its asynchronous implementation, potentially allowing sophisticated man-in-the-middle attacks.
Apache Shindig, despite being a retired project, still presents a deserialization vulnerability (CVE-2026-66256) that could be exploited for arbitrary code execution. Users of this project are advised to migrate to supported alternatives.
The broad impact of this batch of vulnerabilities across multiple Apache projects underscores the need for a comprehensive security strategy. Users should prioritize updating affected components to the latest patched versions, review their configurations for potential weaknesses, and remain vigilant for further security advisories from the Apache Software Foundation. The span of the disclosure, from August 11th to August 15th, 2026, indicates a significant and recent security event requiring immediate attention.