Doris (Apache) - vulnerabilities (CVEs)

7 CVEs, 0 in the last 30 days, 19 known versions, newest CVE from 2026-07-14. Vendor: Apache.

CVEs of Doris

• CVE-2026-58319 - CVSS 9.1 (critical), 2026-07-14: Certain Apache Doris FE HTTP REST administrative APIs were accessible without proper authentication. An unauthenticated attacker with network access to the FE…
• CVE-2024-48019 - CVSS 5.4 (medium), 2025-02-04: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Files or Directories Accessible to External Parties vulnerability in Apache…
• CVE-2024-27438 - CVSS 9.8 (critical), 2024-03-21: Download of Code Without Integrity Check vulnerability in Apache Doris. The jdbc driver files used for JDBC catalog is not checked and may resulting in remote…
• CVE-2024-26307 - CVSS 5.3 (medium), 2024-03-21: Possible race condition vulnerability in Apache Doris. Some of code using `chmod()` method. This method run the risk of someone renaming the file out from…
• CVE-2023-41313 - CVSS 9.8 (critical), 2024-03-12: The authentication method in Apache Doris versions before 2.0.0 was vulnerable to timing attacks. Users are recommended to upgrade to version 2.0.0 + or…
• CVE-2023-41314 - CVSS 8.2 (high), 2023-12-18: The api /api/snapshot and /api/get_log_file would allow unauthenticated access. It could allow a DoS attack or get arbitrary files from FE node.…
• CVE-2022-23942 - CVSS 7.5 (high), 2022-04-26: Apache Doris, prior to 1.0.0, used a hardcoded key and IV to initialize the cipher used for ldap password, which may lead to information disclosure.