CVE-2026-75005highCWE-407

CVE-2026-75005: falha de alta gravidade em Apache APISIX

Apache APISIX: Unauthenticated CPU-exhaustion DoS

Publicada em

Seguir esta CVE+ Monitorar Apache APISIX

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 0.7%
Inefficient Algorithmic Complexity vulnerability in Apache APISIX. A single small request can pin a gateway worker at 100% CPU for an extended period in graphql-limit-count routes. This issue affects Apache APISIX: 3.17.0. Users are recommended to upgrade to version 3.18.0, which fixes the issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
Apache Software Foundation · Apache APISIX
CVEs relacionadas — Apache APISIX

No mesmo produto, das mais perigosas para as menos.

CVE-2022-24112CRITICALapisix/batch-requests plugin allows overwriting the X-REAL-IP headerEPSS 96.1%KEVCVE-2020-13945—CVE-2020-13945EPSS 73.6%CVE-2021-43557—Path traversal in request_uri variableEPSS 13.0%CVE-2022-29266—apisix/jwt-auth may leak secrets in error responseEPSS 8.1%CVE-2022-25757—Apache APISIX: the body_schema check in request-validation plugin can be bypassedEPSS 2.5%CVE-2024-32638MEDIUMApache APISIX: Forward-Auth Request SmugglingEPSS 1.1%