Apache Flink (Apache Software Foundation) - vulnerabilities (CVEs)

3 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2026-05-15. Vendor: Apache Software Foundation.

CVEs of Apache Flink

• CVE-2026-35194 - CVSS 8.1 (high), 2026-05-15: Code injection in SQL code generation in Apache Flink 1.15.0 through 1.20.x and 2.0.0 through 2.x allows authenticated users with query submission privileges…
• CVE-2020-17519 - CVSS 9.1 (critical), 2021-01-05: A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the…
• CVE-2020-17518 - CVSS 7.5 (high), 2021-01-05: Apache Flink 1.5.1 introduced a REST handler that allows you to write an uploaded file to an arbitrary location on the local file system, through a…