org.apache.calcite:calcite-core

3 results · Feed

• Medium 6.5
  CVE-2026-46718

  Apache Calcite: A user-controled model can load arbitrary classes, leading to code execution

  Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Calcite. This issue affects Apache Calcite: from 1.5.0 before 1.42. Users are recommended to upgrade to version 1.42, which fixes the issue.

  Apache Software Foundation Apache Calcite druid opensearch-3-discovery-ec2 Wolfi Maven
  Jun 2, 2026
• Critical 9.8
  CVE-2022-39135

  Apache Calcite: potential XEE attacks

  Apache Calcite 1.22.0 introduced the SQL operators EXISTS_NODE, EXTRACT_XML, XML_TRANSFORM and EXTRACT_VALUE do not restrict XML External Entity references in their configuration, making them vulnerable to a potential XML External Entity (XXE) attack. Therefo…

  Apache Software Foundation Apache Calcite trino trino-plugin-opensearch Wolfi Maven
  Sep 11, 2022
• Medium 5.9
  CVE-2020-13955

  Missing Authentication for Critical Function in Apache Calcite

  HttpUtils#getURLConnection method disables explicitly hostname verification for HTTPS connections making clients vulnerable to man-in-the-middle attacks. Calcite uses internally this method to connect with Druid and Splunk so information leakage may happen wh…

  org.apache.calcite:calcite-core org.apache.calcite:calcite-splunk org.apache.calcite:calcite-druid Maven
  Oct 9, 2020