CVE-2026-94250
HighCVSS 8.2Summary
The batch-requests plugin in Apache APISIX allows allocation of resources without limits or throttling. An unauthenticated caller can drive a gateway worker into OOM via a route where the batch-requests plugin is used and the batch endpoint is publicly exposed. The issue affects Apache APISIX from 1.3.0 through 3.18.0.
Risk Assessment
A publicly exposed batch endpoint can be abused to launch a DoS attack and disrupt the APISIX gateway, impacting service availability.
Recommendation
Upgrade Apache APISIX to version 3.19.0, which fixes the issue.
Other vulnerabilities in Apache APISIX
See all- CVE-2026-94276Medium
Apache APISIX versions 3.12.0 through 3.18.0 contain an improper authentication vulnerability in the openid-connect plugin. A token that is active for one issuer may be accepted on a route restricted to another issuer when remote introspection is used.
- CVE-2026-94269Medium
Apache APISIX versions 2.14.1 through 3.18.0 contain a vulnerability in the use of non-canonical URL paths for authorization decisions. In some configurations where a permissive route overlaps a protected one, a crafted encoded path can reach an upstream endpoint that the matched route's policies were never meant to cover, allowing unauthenticated access.
- CVE-2026-94212Medium
Apache APISIX versions 3.17.0 through 3.18.0 contain an improper verification of cryptographic signature vulnerability in the saml-auth plugin. An unauthenticated attacker can impersonate any user on routes protected by this plugin under default configuration.
- CVE-2026-82806Medium
Vulnerability in Apache APISIX exposing data to the wrong session. Under certain authz-keycloak configurations, a request's authorization scope may persist into later requests on the same route, leading to unintended authorization expansion and inconsistent access-control decisions. Affects versions from 2.3.0 before 3.7.0.
- CVE-2026-78242Medium
A vulnerability in Apache APISIX 3.17.0 causes unmasked header values to be written to the log sink under a certain response structure. The issue is fixed in version 3.18.0.
- CVE-2026-49230Critical
The vulnerability related to improper validation of integrity check value in Apache APISIX allows authentication bypass in the jwe-decrypt plugin under default configuration. This issue affects versions from 3.8.0 to 3.16.0.
- CVE-2026-39999Critical
Authentication Bypass by Spoofing vulnerability in Apache APISIX allows an attacker to completely bypass the authentication process by capitalizing on certain configurations of the jwt-auth plugin. This issue affects Apache APISIX from v2.2 through v3.16.0.
- CVE-2022-24112CriticalActively exploited
In Apache APISIX, an attacker can abuse the batch-requests plugin to bypass the IP restriction of the Admin API. A default configuration (with default API key) is vulnerable to remote code execution; even after changing the admin key or port, there is still a risk of bypassing the IP restriction of the data panel due to a bug in the client IP check.
- CVE-2026-75020High
Apache APISIX versions 2.11.0 through 3.17.0 are vulnerable to LDAP Injection. A caller with valid credentials for one LDAP entry can authenticate as a different consumer, bypassing the plugin's configured scope.
- CVE-2026-75005High
Apache APISIX version 3.17.0 is vulnerable to inefficient algorithmic complexity in graphql-limit-count routes. A single small request can pin a gateway worker at 100% CPU for an extended period.
Original NVD description (English source)
Allocation of resources without limits or throttling vulnerability in batch-requests plugin in Apache APISIX. An unauthenticated caller can drive a gateway worker into OOM via a route where the batch-requests plugin is used and the batch endpoint is publicly exposed. This issue affects Apache APISIX: from 1.3.0 through 3.18.0. Users are recommended to upgrade to version 3.19.0, which fixes the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS