Known Vulnerabilities for Apisix by Apache
Listed below are 9 of the newest known vulnerabilities associated with "Apisix" by "Apache".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-31924 json | Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. tencent-cloud-cls log export uses plaintext ... | Not Provided | 2026-04-14 | 2026-04-14 |
| CVE-2026-31923 json | Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. This can occur due to `ssl_verify` in openid... | Not Provided | 2026-04-14 | 2026-04-14 |
| CVE-2026-31908 json | Header injection vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in forward-auth pl... | Not Provided | 2026-04-14 | 2026-04-16 |
| CVE-2023-44487 json | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many stre... | 7.5 - HIGH | 2023-10-10 | 2024-02-02 |
| CVE-2022-29266 json | In APache APISIX before 3.13.1, the jwt-auth plugin has a security issue that leaks the user's secret key because the error m... | 7.5 - HIGH | 2022-04-20 | 2022-04-29 |
| CVE-2022-25757 json | In Apache APISIX before 2.13.0, when decoding JSON with duplicate keys, lua-cjson will choose the last occurred value as the ... | 9.8 - CRITICAL | 2022-03-28 | 2022-04-04 |
| CVE-2022-24112 json | An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configu... | 9.8 - CRITICAL | 2022-02-11 | 2022-05-11 |
| CVE-2021-43557 json | The uri-block plugin in Apache APISIX before 2.10.2 uses $request_uri without verification. The $request_uri is the full orig... | 7.5 - HIGH | 2021-11-22 | 2021-11-26 |
| CVE-2020-13945 json | In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the defau... | 6.5 - MEDIUM | 2020-12-07 | 2022-04-19 |