CVE-2022-42468: Apache Flume

Critical severity, CVSS 9.8. EPSS: 3% chance of exploitation in the next 30 days.

Apache Flume versions 1.4.0 through 1.10.1 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with an unsafe providerURL. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol.

Affected products

• Apache Flume: from 1.4.0, up to and including 1.10.1

Published 2022-10-26. Last modified 2026-06-17.