Apache Guacamole (Apache Software Foundation) - vulnerabilities (CVEs)

8 CVEs, 0 in the last 30 days, 4 known versions, newest CVE from 2025-07-02. Vendor: Apache Software Foundation.

CVEs of Apache Guacamole

• CVE-2024-35164 - CVSS 7.5 (high), 2025-07-02: The terminal emulator of Apache Guacamole 1.5.5 and older does not properly validate console codes received from servers via text-based protocols like SSH. If…
• CVE-2023-43826 - CVSS 8.8 (high), 2023-12-19: Apache Guacamole 1.5.3 and older do not consistently ensure that values received from a VNC server will not result in integer overflow. If a user connects to…
• CVE-2023-30576 - CVSS 8.1 (high), 2023-06-07: Apache Guacamole 0.9.10 through 1.5.1 may continue to reference a freed RDP audio input buffer. Depending on timing, this may allow an attacker to execute…
• CVE-2023-30575 - CVSS 7.5 (high), 2023-06-07: Apache Guacamole 1.5.1 and older may incorrectly calculate the lengths of instruction elements sent during the Guacamole protocol handshake, potentially…
• CVE-2021-43999 - CVSS 8.8 (high), 2022-01-11: Apache Guacamole 1.2.0 and 1.3.0 do not properly validate responses received from a SAML identity provider. If SAML support is enabled, this may allow a…
• CVE-2021-41767 - CVSS 6.5 (medium), 2022-01-11: Apache Guacamole 1.3.0 and older may incorrectly include a private tunnel identifier in the non-private details of some REST responses. This may allow an…
• CVE-2018-1340 - CVSS 7.5 (high), 2019-02-07: Prior to 1.0.0, Apache Guacamole used a cookie for client-side storage of the user's session token. This cookie lacked the "secure" flag, which could allow an…
• CVE-2017-3158 - CVSS 8.1 (high), 2018-01-18: A race condition in Guacamole's terminal emulator in versions 0.9.5 through 0.9.10-incubating could allow writes of blocks of printed data to overlap. Such…