Apache
DevOps & ToolsOpen-source web servers and software foundation projects (HTTP Server, Tomcat, Kafka, Cassandra, James).
apache.org30-day hazard rating
- Incidents (30d)
- 4
- Severity-weighted volume
- 11.0
- Critical / high (clustered)
- 2 / 2
- Avg time to resolve
- n/a
Volume of incidents (weighted by severity) over the last 30 days, raised when fixes are slow. 1 = calm, 10 = constant breakage.
- Incidents, 30 days
- 4
- +300%vs prior 30 days
- Reports, 30 days
- 6
- Active advisories
- 5
- Regression lifespan
- n/a
- nothing resolved yet
Incidents per day, last 30 days
View as table
| Date | Incidents | Reports |
|---|---|---|
| 2026-11-07 | 0 | 0 |
| 2026-11-06 | 4 | 6 |
| 2026-11-05 | 0 | 0 |
| 2026-11-04 | 0 | 0 |
| 2026-11-03 | 0 | 0 |
| 2026-11-02 | 0 | 0 |
| 2026-11-01 | 0 | 0 |
| 2026-10-31 | 0 | 0 |
| 2026-10-30 | 0 | 0 |
| 2026-10-29 | 0 | 0 |
| 2026-10-28 | 0 | 0 |
| 2026-10-27 | 0 | 0 |
| 2026-10-26 | 0 | 0 |
| 2026-10-25 | 0 | 0 |
| 2026-10-24 | 0 | 0 |
| 2026-10-23 | 0 | 0 |
| 2026-10-22 | 0 | 0 |
| 2026-10-21 | 0 | 0 |
| 2026-10-20 | 0 | 0 |
| 2026-10-19 | 0 | 0 |
| 2026-10-18 | 0 | 0 |
| 2026-10-17 | 0 | 0 |
| 2026-10-16 | 0 | 0 |
| 2026-10-15 | 0 | 0 |
| 2026-10-14 | 0 | 0 |
| 2026-10-13 | 0 | 0 |
| 2026-10-12 | 0 | 0 |
| 2026-10-11 | 0 | 0 |
| 2026-10-10 | 0 | 0 |
| 2026-10-09 | 0 | 0 |
Active advisories
- highInvestigating
Apache James Mime4J Library Denial of Service
CVE-2026-85111 in Apache James Mime4J library leads to a Denial of Service (DoS) vulnerability. Users are advised to upgrade to version 3.9.1 or higher, which includes the fix for this issue.
Apache1 day agovApache James server 3.9.1 or higher, which includes fixed MIME4J version 0.8.15
Velocity1.4 - criticalInvestigating
Apache James server: CVE-2026-76168 (Critical)
Apache James server prior to version 3.9.1 is vulnerable to a critical path traversal vulnerability, allowing attackers to set arbitrary SIEVE scripts for other users, leading to denial of service or traffic capture. Users are recommended to upgrade to version 3.9.1.
Apache1 day agovprior to version 3.9.1
Velocity1.4 - highInvestigating
Apache James server: CVE-2026-49939 (High)
Apache James server prior to version 3.9.1 is vulnerable to a High severity issue where improper Access Control List processing in the JMAP protocol allows users to administer folders despite being denied rights in IMAP.
Apache1 day agovprior to version 3.9.1
Velocity1.4 - criticalInvestigating
Apache James 3.9.1 SASL OAuthBearer/XOAUTH2 Vulnerability
Apache James version 3.9.1 is affected by a critical vulnerability (CVE-2025-66621) where the SASL OAuthBearer/XOAUTH2 module fails to validate AUD claim of JWT payloads, allowing unauthorized access if introspection is not configured. Users are recommended to upgrade to non-vulnerable versions that enforce explicit configuration of aud claims and introspection.
Apache1 day agov3.9.1
Velocity1.4 - highInvestigating
Apache Struts: CVE-2016-3081 Command Injection
CVE-2016-3081, an Apache Struts vulnerability, has been published. Mitigations should be applied in accordance with vendor instructions and CISA guidance to ensure security.
Apache1 month ago
Velocity0.0
Version hazard notices
- Avoid:
Apache 3.9.11 active critical-severity incident- criticalInvestigatingApache James 3.9.1 SASL OAuthBearer/XOAUTH2 Vulnerability
- Avoid:
Apache prior to version 3.9.12 active critical-severity incidents- criticalInvestigatingApache James server: CVE-2026-76168 (Critical)
- highInvestigatingApache James server: CVE-2026-49939 (High)
- Avoid:
Apache Apache James server 3.9.1 or higher, which includes fixed MIME4J version 0.8.151 active high-severity incident- highInvestigatingApache James Mime4J Library Denial of Service
Resolved incident history
No resolved incidents on record yet.