GCVE - cpe:2.3:a:apache:hugegraph:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:apache:hugegraph:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Apache (`b0303047-b7dd-5cf8-abcc-71b7d9d80b95`)
Product	Hugegraph (`8f1f5940-b411-5886-8fee-8d35f56b222e`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/apache/incubator-hugegraph`	purl2cpe	2026-06-01 10:14:33.220104

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-26866`	vulnerable	2026-06-08 07:14:50.591001	Apache HugeGraph-Server: RAFT and deserialization vulnerability A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store. The fix enforces IP-based authentication to restrict cluster membership and implements a strict class whitelist to harden the Hessian serialization process against object injection attacks. Users are recommended to upgrade to version 1.7.0, which fixes the issue. Published: 2025-12-12T09:23:07.681Z Updated: 2026-02-26T16:07:42.192Z Open on db.gcve.eu Reference links https://github.com/apache/incubator-hugegraph/pull/2735 https://lists.apache.org/thread/ko8jkwbjbb99m45pg4sgo5xsm8gx9nsq	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-43441`	vulnerable	2026-06-08 06:45:51.328346	Apache HugeGraph-Server: Fixed JWT Token(Secret) Authentication Bypass by Assumed-Immutable Data vulnerability in Apache HugeGraph-Server. This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.5.0. Users are recommended to upgrade to version 1.5.0, which fixes the issue. Published: 2024-12-24T11:59:59.219Z Updated: 2024-12-31T18:47:44.461Z Open on db.gcve.eu Reference links https://lists.apache.org/thread/h2607yv32wgcrywov960jpxhvsmmlf12	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-27349`	vulnerable	2026-06-08 06:31:28.573915	Apache HugeGraph-Server: Bypass whitelist in Auth mode Authentication Bypass by Spoofing vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0. Users are recommended to upgrade to version 1.3.0, which fixes the issue. Published: 2024-04-22T14:08:56.591Z Updated: 2025-08-21T03:55:17.018Z Open on db.gcve.eu Reference links https://lists.apache.org/thread/dz9n9lndqfsf64t72o73r7sttrc6ocsd http://www.openwall.com/lists/oss-security/2024/04/22/4	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-27348`	vulnerable	2026-06-08 06:31:28.573184	Apache HugeGraph-Server: Command execution in gremlin RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11 Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue. Published: 2024-04-22T14:08:06.294Z Updated: 2025-10-21T23:05:21.096Z Open on db.gcve.eu Reference links https://hugegraph.apache.org/docs/config/config-authentication/#configure-user-authentication https://lists.apache.org/thread/nx6g6htyhpgtzsocybm242781o8w5kq9 http://www.openwall.com/lists/oss-security/2024/04/22/3	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.