oscerd/security-researchVulnerabilities I've reported to the Apache Software Foundation: 46 CVEs across 15 projects
Vulnerabilities I have reported to the Apache Software Foundation, disclosed through the ASF security process. 29 CVEs across 15 projects, 2023 to 2026. I also wrote the remediation for 84 more that other people found - not a credit of mine, and listed separately in the third table.
Where a public reproducer exists it is linked. Each one is a minimal, self-contained project that demonstrates the issue and names the release that fixed it.
Across 22 distinct CWEs, the most frequent class is deserialization of untrusted data (4), followed by observable timing discrepancy, server-side request forgery, insufficient session expiration and improper input validation (2 each).
| CVE | Component | Class | Fixed in | PoC |
|---|---|---|---|---|
| CVE-2023-41313 | Doris | CWE-208 Observable Timing Discrepancy | 1.2.8 | - |
| CVE-2023-41834 | Flink Stateful Functions | CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component | 3.3.0 | - |
| CVE-2023-43123 | Storm | CWE-200 Exposure of Sensitive Information to an Unauthorized Actor | 2.6.0 | - |
| CVE-2024-23454 | Hadoop | CWE-378 Creation of Temporary File With Insecure Permissions | 3.4.0 | - |
| CVE-2024-23953 | Hive | CWE-208 Observable Timing Discrepancy | 4.0.0 | - |
| CVE-2024-29869 | Hive | CWE-732 Incorrect Permission Assignment for Critical Resource | 4.0.1 | - |
| CVE-2026-28672 | Ranger | CWE-77 Improper Neutralization of Special Elements used in a Command | 2.9.0 | reproducer |
| CVE-2026-34476 | SkyWalking MCP | CWE-918 Server-Side Request Forgery | not published | - |
| CVE-2026-40005 | IoTDB | CWE-22 Improper Limitation of a Pathname to a Restricted Directory | 2.0.10 | - |
| CVE-2026-40008 | IoTDB | CWE-470 Use of Externally-Controlled Input to Select Classes or Code | 2.0.10 | - |
| CVE-2026-40564 | Flink Kubernetes Operator | CWE-918 Server-Side Request Forgery | 1.15.0 | reproducer |
| CVE-2026-41041 | Gravitino | CWE-177 Improper Handling of URL Encoding | 1.2.1 | - |
| CVE-2026-44616 | Zeppelin | CWE-90 Improper Neutralization of Special Elements used in an LDAP Query | 0.12.1 | - |
| CVE-2026-49361 | Fluss (incubating) | CWE-400 Uncontrolled Resource Consumption | not published | - |
| CVE-2026-63039 | InLong | CWE-89 Improper Neutralization of Special Elements used in an SQL Command | 2.4.0 | reproducer |
| CVE-2026-64640 | Polaris | CWE-863 Incorrect Authorization | 1.7.0 | reproducer |
Camel is the project I maintain, so it gets the most scrutiny. These are the ones I found myself: mostly unsafe deserialization in aggregation repositories and migration paths, plus token and session handling that kept accepting what it should have expired.
| CVE | Component | Class | Fixed in | PoC |
|---|---|---|---|---|
| CVE-2024-23114 | Camel | CWE-502 Deserialization of Untrusted Data | 3.21.4, 3.22.1, 4.0.4, 4.4.0 | - |
| CVE-2026-23552 | Camel | CWE-346 Origin Validation Error | 4.18.0 | reproducer |
| CVE-2026-25747 | Camel LevelDB | CWE-502 Deserialization of Untrusted Data | 4.10.9, 4.14.5, 4.18.0 | reproducer |
| CVE-2026-27172 | Camel | CWE-502 Deserialization of Untrusted Data | 4.14.6, 4.18.1 | reproducer |
| CVE-2026-40047 | Camel | CWE-88 Improper Neutralization of Argument Delimiters in a Command | 4.18.3 | reproducer |
| CVE-2026-40048 | Camel PQC | CWE-502 Deserialization of Untrusted Data | 4.18.2, 4.20.0 | reproducer |
| CVE-2026-46455 | Camel | CWE-613 Insufficient Session Expiration | 4.18.3, 4.21.0 | reproducer |
| CVE-2026-46585 | Camel Lucene | CWE-639 Authorization Bypass Through User-Controlled Key | 4.14.8, 4.18.3, 4.21.0 | reproducer |
| CVE-2026-63621 | Camel Knative | CWE-20 Improper Input Validation | 4.14.9, 4.18.4, 4.22.0 | reproducer |
| CVE-2026-78329 | Camel Undertow | CWE-20 Improper Input Validation | 4.14.9, 4.18.4, 4.22.0 | reproducer |
| CVE-2026-94386 | Camel OAuth | CWE-524 Use of Cache Containing Sensitive Information | 4.22.2, 4.23.0 | reproducer |
| CVE-2026-95663 | Camel Keycloak | CWE-613 Insufficient Session Expiration | 4.18.5, 4.22.2, 4.23.0 | reproducer |
| CVE-2026-95664 | Camel AWS2 S3 | CWE-917 Expression Language Injection | 4.18.5, 4.22.2, 4.23.0 | reproducer |
As the maintainer who handles Camel's security reports, I take the ones that come in from outside - and the ones internal analysis turns up - through triage, the fix, the backports to the supported LTS lines and the advisory, and I publish a reproducer to confirm the issue and validate the fix. These are not my findings. The finder credit belongs to the reporters named below. Of the 91, I wrote the remediation for 84; the rest were fixed by other committers.
