CVE-2026-46718: Apache Calcite

Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days.

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Calcite. This issue affects Apache Calcite: from 1.5.0 before 1.42. Users are recommended to upgrade to version 1.42, which fixes the issue.

Affected products

• Apache Calcite: from 1.5.0, before 1.42.0 (fixed in 1.42.0)

Published 2026-06-02. Last modified 2026-07-22.