Apache Calcite vulnerabilities

3 CVEs affecting Apache Calcite, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-46718, published 2026-06-02.

More from Apache.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2022-39135, published 2022-09-11. Critical severity, CVSS 9.8. EPSS: 2.2% chance of exploitation in the next 30 days. Apache Calcite 1.22.0 introduced the SQL operators EXISTS_NODE, EXTRACT_XML, XML_TRANSFORM and EXTRACT_VALUE do not restrict XML External Entity references in their configuration, making them…
• CVE-2020-13955, published 2020-10-09. Medium severity, CVSS 5.9. EPSS: 2.1% chance of exploitation in the next 30 days. HttpUtils#getURLConnection method disables explicitly hostname verification for HTTPS connections making clients vulnerable to man-in-the-middle attacks. Calcite uses internally this method to…
• CVE-2026-46718, published 2026-06-02. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Calcite. This issue affects Apache Calcite: from 1.5.0 before 1.42. Users are recommended…