SB2026082617 - Multiple vulnerabilities in Apache APISIX

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026082617

SB2026082617 - Multiple vulnerabilities in Apache APISIX

Published: August 26, 2026 Updated: August 27, 2026

Security Bulletin ID SB2026082617
CSH Severity
High
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 25% Medium 50% Low 25%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Reliance on Untrusted Inputs in a Security Decision (CVE-ID: CVE-2026-63041)

CWE-ID: CWE-807 - Reliance on Untrusted Inputs in a Security Decision

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to escalate privileges or perform an authorization bypass.

The vulnerability exists due to reliance on untrusted inputs in a security decision in the attach-consumer-label plugin when handling client-supplied consumer-label headers. A remote attacker can send certain header values to escalate privileges or perform an authorization bypass.


2) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-74848)

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to make other clients receive attacker-chosen or other users' responses.

The vulnerability exists due to inconsistent interpretation of http requests in serverless-plugin routes when handling crafted http requests. A remote attacker can send crafted requests to make other clients receive attacker-chosen or other users' responses.


3) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-75005)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to inefficient algorithmic complexity in graphql-limit-count routes when handling a small crafted request. A remote attacker can send a small crafted request to cause a denial of service.

A single request can pin a gateway worker at 100% CPU for an extended period.


4) LDAP injection (CVE-ID: CVE-2026-75020)

CWE-ID: CWE-90 - Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to impersonate another identity.

The vulnerability exists due to improper neutralization of special elements used in an LDAP query in the ldap-auth plugin when authenticating against the LDAP directory. A remote user can supply crafted credentials to impersonate another identity.

The issue affects consumer mapping across LDAP subtrees that were intended to be outside the configured scope.


Remediation

Install update from vendor's website.

References