Alertas de Seguridad de la Información

A Alto vulnerabilidad

06/07/2026

[CVE-2026-42527] Deserialization of Untrusted Data vulnerability in Apache Camel. The default ObjectInputFilter patt…

Deserialization of Untrusted Data vulnerability in Apache Camel. The default ObjectInputFilter pattern shipped with several Apache Camel components for defense-in-depth deserialization filtering ('java.**;javax.**;org.apache.camel.**;!*', or the no-'javax.**' variant in the aggregation-repository components) uses a recursive 'java.**' glob that admits classes whose hashCode/equals/readObject meth…

nvdaltovulnerabilidad CVSS 8.1 NVD

A Alto vulnerabilidad

06/07/2026

[CVE-2026-43865] Deserialization of Untrusted Data vulnerability in Apache Camel Hazelcast component. The camel-haze…

Deserialization of Untrusted Data vulnerability in Apache Camel Hazelcast component. The camel-hazelcast component creates and manages Hazelcast instances using a default configuration that applies no Java deserialization filter. When Camel builds the Hazelcast Config itself - that is, when no user-supplied HazelcastInstance, hazelcastConfigUri, or referenced Config bean is provided - neither Haz…

nvdaltovulnerabilidad CVSS 8.1 NVD

A Alto vulnerabilidad

06/07/2026

[CVE-2026-43866] Deserialization of Untrusted Data vulnerability in Apache Camel, Apache Camel JMS component. JmsBin…

Deserialization of Untrusted Data vulnerability in Apache Camel, Apache Camel JMS component. JmsBinding.extractBodyFromJms() in camel-jms - and the equivalent JmsBinding in camel-sjms - deserializes the payload of an incoming JMS ObjectMessage via jakarta.jms.ObjectMessage.getObject() whenever the mapJmsMessage option is enabled (the default) and Camel acts as a JMS consumer. The CVE-2026-40860 h…

nvdaltovulnerabilidad CVSS 7.3 NVD

A Alto vulnerabilidad

03/07/2026

[CVE-2026-47896] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apac…

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Lucene.Net (Lucene.Net.Replicator library). This issue affects Apache Lucene.Net.Replicator: from 4.8.0-beta00005 through 4.8.0-beta00017. Users are recommended to upgrade to version 4.8.0-beta00018, which fixes the issue.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

03/07/2026

[CVE-2026-47897] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apac…

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Lucene.Net (Lucene.Net.Replicator library). This issue affects Apache Lucene.Net.Replicator: from 4.8.0-beta00005 before 4.8.0-beta00018. Users are recommended to upgrade to version 4.8.0-beta00018, which fixes the issue.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Crítico vulnerabilidad

03/07/2026

[CVE-2026-47898] Improper Restriction of XML External Entity Reference vulnerability in Apache Lucene.Net (Lucene.Net…

Improper Restriction of XML External Entity Reference vulnerability in Apache Lucene.Net (Lucene.Net.Analysis.Common library). This issue affects Apache Lucene.Net.Analysis.Common: from 4.8.0-beta00005 before 4.8.0-beta00018. Users are recommended to upgrade to version 4.8.0-beta00018, which fixes the issue.

nvdcriticovulnerabilidad CVSS 9.8 NVD

A Alto vulnerabilidad

01/07/2026

[CVE-2026-54428] Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpCompo…

Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending oversized compressed header blocks before the HTTP/2 SETTINGS acknowledgement causes the configured header list size limit to be applied.

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

01/07/2026

[CVE-2026-54399] Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpCompone…

Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote attacker to cause a denial of service through memory exhaustion by sending messages with excessive number of headers / excessive header length

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

30/06/2026

[CVE-2026-53916] Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, A…

Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp. An unauthenticated client that opens a STOMP NIO connection can send header bytes that never terminate which makes the broker buffer them without limit, exhausting the JVM heap. This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7; Apache ActiveMQ All: …

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

30/06/2026

[CVE-2026-53917] Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, A…

Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker. An authenticated user can cause a broker DoS by sending a crafted OpenWire Message with a large encoded size value for the map. OpenWire message property maps are unmarshaled without size validation which can trigger OOM and crash the broker. This issu…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

30/06/2026

[CVE-2026-54475] Missing Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.…

Missing Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic temporary destinations are expected to be isolated to the connection that created them. The isolation can be broken as this is only checked in the client, allowing a different connection to consume from another connection's temporary destination. This issue affects Apache A…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

30/06/2026

[CVE-2026-49432] Improper Input Validation vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Sto…

Improper Input Validation vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp. A remote unauthenticated peer that can reach an exposed STOMP connector can trigger denial-of-service behavior by sending a negative content-length. For the NIO STOMP transport, an attacker can keep streaming body bytes and grow the per-connection command buffer beyond configured limits to caus…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

30/06/2026

[CVE-2026-49434] Improper Input Validation vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ …

Improper Input Validation vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. An attacker that has access to publish or modify entries in LDAP that match the configured searchBase and searchFilter can instantiate denied transports inside the broker JVM. This can be used to fetch an attacker URL and spawn a second BrokerService inside the same JVM. This issue affects Apa…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

30/06/2026

[CVE-2026-49877] Improper Authorization vulnerability in Apache ActiveMQ. An authenticated low-privilege Web Console…

Improper Authorization vulnerability in Apache ActiveMQ. An authenticated low-privilege Web Console user by default can access /admin/* paths in the Web Console. The default Jetty settings incorrectly did not limit those paths to only admins. This issue affects Apache ActiveMQ: before 5.19.8, from 6.0.0 before 6.2.7. Users are recommended to upgrade to version 6.2.7 or 5.19.8, which fixes the is…

nvdaltovulnerabilidad CVSS 8.1 NVD

A Alto vulnerabilidad

30/06/2026

[CVE-2026-50734] Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ Client, Apache ActiveMQ…

Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All. An unauthenticated network attacker can cause a broker DoS by sending a crafted WireFormatInfo frame with a malicious large size value. The value is not validate and causes the broker to attempt allocation during pre-auth negotiation which can trigger OOM and crash the broker…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Alto vulnerabilidad

30/06/2026

[CVE-2026-50750] Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache…

Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. Following the fix for CVE-2026-49270 an unauthenticated attacker can now cause broker OOM by sending an repeated BrokerInfo commands without sending a ConnectionInfo, until the broker will crash with OOM. This issue affects Apache ActiveMQ Broker: from 5.19.7 before 5.19.8, from 6.2…

nvdaltovulnerabilidad CVSS 7.5 NVD

A Crítico vulnerabilidad

29/06/2026

[CVE-2026-55276] Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles…

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support …

nvdcriticovulnerabilidad CVSS 9.1 NVD

A Alto vulnerabilidad

29/06/2026

[CVE-2026-55957] Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was config…

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. U…

nvdaltovulnerabilidad CVSS 7.3 NVD

A Alto vulnerabilidad

29/06/2026

[CVE-2026-53404] Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant th…

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat's rewrite valve meant that if the first condition in an OR chain matched, subsequent non-OR conditions were skipped. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support m…

nvdaltovulnerabilidad CVSS 7.3 NVD

A Crítico vulnerabilidad

29/06/2026

[CVE-2026-53434] Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for…

Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.

nvdcriticovulnerabilidad CVSS 9.1 NVD