Apache Software Foundation Apache Calcite vulnerabilities
2 known vulnerabilities affecting apache_software_foundation/apache_calcite.
Total CVEs
2
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL1MEDIUM1
Vulnerabilities
Page 1 of 1
CVE-2022-39135P3CRITICALCVSS 9.8≥ 1.22.0, < 1.32.02022-09-11
CVE-2022-39135 [CRITICAL] CWE-611 CVE-2022-39135: Apache Calcite 1.22.0 introduced the SQL operators EXISTS_NODE, EXTRACT_XML, XML_TRANSFORM and EXTRA
Apache Calcite 1.22.0 introduced the SQL operators EXISTS_NODE, EXTRACT_XML, XML_TRANSFORM and EXTRACT_VALUE do not restrict XML External Entity references in their configuration, making them vulnerable to a potential XML External Entity (XXE) attack. Therefore any client exposing these operators, typically by using Oracle dialect (the first three
nvd
CVE-2026-46718P3MEDIUMCVSS 6.5≥ 1.5.0, < 1.422026-06-02
CVE-2026-46718 [MEDIUM] CWE-470 CVE-2026-46718: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Calcite.
This issue affects Apache Calcite: from 1.5.0 before 1.42.
Users are recommended to upgrade to version 1.42, which fixes the issue.
nvd