Apache Tapestry (Apache Software Foundation) - vulnerabilities (CVEs)

6 CVEs, 0 in the last 30 days, 1 known versions, newest CVE from 2026-08-10. Vendor: Apache Software Foundation.

CVEs of Apache Tapestry

• CVE-2026-61899 - CVSS 7.5 (high), 2026-08-10: Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are…
• CVE-2022-46366 - CVSS 9.8 (critical), 2022-12-02: Apache Tapestry 3.x allows deserialization of untrusted data, leading to remote code execution. This issue is similar to but distinct from CVE-2020-17531,…
• CVE-2022-31781 - CVSS 7.5 (high), 2022-07-13: Apache Tapestry up to version 5.8.1 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles Content Types. Specially crafted…
• CVE-2021-30638 - CVSS 7.5 (high), 2021-04-27: Information Exposure vulnerability in context asset handling of Apache Tapestry allows an attacker to download files inside WEB-INF if using a…
• CVE-2021-27850 - CVSS 9.8 (critical), 2021-04-15: A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestry. The affected versions include 5.4.5, 5.5.0,…
• CVE-2020-17531 - CVSS 9.8 (critical), 2020-12-08: A Java Serialization vulnerability was found in Apache Tapestry 4. Apache Tapestry 4 will attempt to deserialize the "sp" parameter even before invoking the…