CVE-2021-44791: Apache Druid

Medium severity, CVSS 6.1. EPSS: 2.2% chance of exploitation in the next 30 days.

In Apache Druid 0.22.1 and earlier, certain specially-crafted links result in unescaped URL parameters being sent back in HTML responses. This makes it possible to execute reflected XSS attacks.

Affected products

• Apache Druid: up to and including 0.22.1

Published 2022-07-07. Last modified 2026-06-17.