org.apache.hugegraph vulnerabilities

Products

• org.apache.hugegraph/hugegraph-api 2
• org.apache.hugegraph/hg-pd-core 1
• org.apache.hugegraph/hugegraph-core 1
• org.apache.hugegraph/hugegraph-hubble 1
• org.apache.hugegraph/hugegraph-server 1

Latest org.apache.hugegraph CVEs

Newest publication first

1. CVE-2025-26866 Apache HugeGraph-Server: RAFT and deserialization vulnerability

   Published 2025-12-12

   High·CVSS 8.1

   A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store. The fix enforces IP-based authentication to restrict cluster membership and implements a strict class whitelist to harden the Hessian seriali...

2. CVE-2024-27348 Apache HugeGraph-Server: Command execution in gremlin

   Published 2024-04-22

   Critical·CVSS 9.3 EPSS 99.2% CISA KEV added 2024-09-18 Exploited in the wild Framework module Public exploit

   RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11 Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.

3. CVE-2024-43441 Apache HugeGraph-Server: Fixed JWT Token (Secret)

   Critical·CVSS 9.8

   Authentication Bypass by Assumed-Immutable Data vulnerability in Apache HugeGraph-Server. This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.5.0. Users are recommended to upgrade to version 1.5.0, which fixes the issue.

4. CVE-2024-27347 Apache HugeGraph-Hubble: SSRF in Hubble connection page

   Medium·CVSS 5.3

   Server-Side Request Forgery (SSRF) vulnerability in Apache HugeGraph-Hubble. This issue affects Apache HugeGraph-Hubble: from 1.0.0 before 1.3.0. Users are recommended to upgrade to version 1.3.0, which fixes the issue.

5. CVE-2024-27349 Apache HugeGraph-Server: Bypass whitelist in Auth mode

   High·CVSS 8.8

   Authentication Bypass by Spoofing vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0. Users are recommended to upgrade to version 1.3.0, which fixes the issue.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.