The Apache Software Foundation

Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smuggling

Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization

Apache Sling Engine: Include-protection mitigations bypassable via uncovered response-wrapper paths

Apache Directory LDAP API: Denial of service via crafted telephone number values

Apache Commons BCEL: Class repositories cache class files under their self-declared names, enabling cache poisoning

Apache Directory LDAP API: Unsafe loading of Java code from LDAP schema elements

Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies

Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens

Apache log4net: NUL character truncates OutputDebugStringAppender records

Apache log4net: RemoteSyslogAppender silently deletes non-ASCII content