Vulnerability record · CVE-2022-42468 · published 26 October 2022

CVE-2022-42468: Apache flume improper input validation vulnerability

Apache · Flume

Apache Flume versions 1.4.0 through 1.10.1 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol.

9.8 CVSS 3.1 Critical EPSS 2.9% · top 13.4% CWE-20 · Improper input validationCWE-74 · Injection

9.8CVSS 3.1 base score

2.9%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

6References

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Flume Apache

References

Link	Tags
https://issues.apache.org/jira/browse/FLUME-3437	Issue TrackingVendor Advisory
https://lists.apache.org/thread/1ckhmp539zr2nd2rs45pocpywk2d9zvz	Mailing ListVendor Advisory
https://lists.apache.org/thread/939wkx8o90bp6m2ht3t1sdyo1ncypl78	Mailing ListPatchVendor Advisory
https://issues.apache.org/jira/browse/FLUME-3437	Issue TrackingVendor Advisory
https://lists.apache.org/thread/1ckhmp539zr2nd2rs45pocpywk2d9zvz	Mailing ListVendor Advisory
https://lists.apache.org/thread/939wkx8o90bp6m2ht3t1sdyo1ncypl78	Mailing ListPatchVendor Advisory

Track CVE-2022-42468 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-34916Apache flume improper input validation vulnerabilityApache Flume versions 1.4.0 through 1.10.0 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with a JNDI …EPSS 2.9%21 Aug 2022 9.8CVE-2022-25167Apache flume improper input validation vulnerabilityApache Flume versions 1.4.0 through 1.9.0 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with a JNDI L…EPSS 5.1%14 Jun 2022 9.5CVE-2026-88771Citrix NetScaler Improper Input Validation VulnerabilityImproper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-…KEV27 Sep 2026 9.5CVE-2026-93952Arista velocloud orchestrator improper input validation vulnerabilityVeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality an…KEVEPSS 0.90%22 Sep 2026 8.8CVE-2019-1068Microsoft SQL Server improper input validation remote code executionMicrosoft SQL Server mishandles processing of internal functions, allowing an authenticated remote attacker to execute code on the database server. T…KEVEPSS 58%analysed15 Jul 2019 5.9CVE-2025-68686FortiOS symbolic link patch bypass exposes sensitive informationFortiOS contains an information exposure flaw (CWE-200) that lets a remote unauthenticated attacker bypass the patch for the symbolic link persistenc…KEVEPSS 30%analysed10 Feb 2026 9.3CVE-2026-12569PTC Windchill PDMlink and FlexPLM deserialization RCEPTC Windchill PDMlink and FlexPLM contain a deserialization of untrusted data flaw (also classified as improper input validation) that allows remote …KEVEPSS 46%analysed18 Jun 2026 10.0CVE-2026-34910Ubiquiti UniFi OS input validation flaw allows command injectionUniFi OS devices contain an improper input validation vulnerability (CWE-20) that lets a network-reachable attacker inject and execute commands. It a…KEVEPSS 46%analysed22 May 2026

Source: NIST National Vulnerability Database (record CVE-2022-42468), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.