Changes.Watch~ upgrade verdicts ~
Free digest
CriticalPHP2Shell: is your PHP patched?

critical vulnerability

Apache Calcite before 1.32.0 vulnerable to potential XML External Entity (XXE) attack

Fix availableCritical · CVSS 9.8EPSS 2.2%

Published Sep 12, 2022 · updated Sep 29, 2026

What to do

  1. Upgrade to a fixed version: org.apache.calcite:calcite-core 1.32.0.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

Mavenorg.apache.calcite:calcite-core

Vulnerable versions
>= 1.22.0, < 1.32.0
Fixed in
1.32.0

Check your project: mvn dependency:tree -Dincludes=org.apache.calcite:calcite-core

Sources

CWE-611 Improper Restriction of XML External Entity Reference

← All critical vulnerabilities