Apache Software Foundation Apache APISIX vulnerabilities

CVEs per yearBy the year they were published

1. 20201
2. 20211
3. 20223
4. 20241
5. 20252
6. 202626

Known exploitedNewest addition to KEV first

• CVE-2022-24112

  apisix/batch-requests plugin allows overwriting the X-REAL-IP header

  Apache Software Foundation · Apache APISIX

  ExploitedCritical9.8

Newest CVEs

• CVE-2026-94276

  Apache APISIX: Openid-connect introspection validation issue

  Apache Software Foundation · Apache APISIX

  Medium5.1
• CVE-2026-94269

  Apache APISIX: Servlet-style normalization creates a route/upstream authorization mismatch

  Apache Software Foundation · Apache APISIX

  Medium6.3
• CVE-2026-94250

  Apache APISIX: Batch response aggregation can exhaust worker memory

  Apache Software Foundation · Apache APISIX

  High8.2
• CVE-2026-94220

  Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth plugin

  Apache Software Foundation · Apache APISIX

  Low2.1
• CVE-2026-94212

  Apache APISIX: unauthenticated impersonation issue in saml-auth

  Apache Software Foundation · Apache APISIX

  Medium6.4
• CVE-2026-82806

  Apache APISIX: cross-request permission pollution via static permission list mutation

  Apache Software Foundation · Apache APISIX

  Medium5.3
• CVE-2026-78242

  Apache APISIX: data-mask may fail to redact request headers in logger output

  Apache Software Foundation · Apache APISIX

  Medium5.7
• CVE-2026-74848

  Apache APISIX: Cross-user response poisoning in serverless plugins

  Apache Software Foundation · Apache APISIX

  High7.0
• CVE-2026-75005

  Apache APISIX: Unauthenticated CPU-exhaustion DoS

  Apache Software Foundation · Apache APISIX

  High8.7
• CVE-2026-75020

  Apache APISIX: ldap-auth plugin cross-subtree identity impersonation

  Apache Software Foundation · Apache APISIX

  High7.0