org.apache.calcite:calcite-core

2 results · Clear filters · Feed

• Medium 6.5
  CVE-2026-46718

  Apache Calcite: A user-controled model can load arbitrary classes, leading to code execution

  Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Calcite. This issue affects Apache Calcite: from 1.5.0 before 1.42. Users are recommended to upgrade to version 1.42, which fixes the issue.

  Apache Software Foundation Apache Calcite druid opensearch-3-discovery-ec2 Wolfi Maven
  Jun 2, 2026
• Medium 5.9
  CVE-2020-13955

  Missing Authentication for Critical Function in Apache Calcite

  HttpUtils#getURLConnection method disables explicitly hostname verification for HTTPS connections making clients vulnerable to man-in-the-middle attacks. Calcite uses internally this method to connect with Druid and Splunk so information leakage may happen wh…

  org.apache.calcite:calcite-core org.apache.calcite:calcite-splunk org.apache.calcite:calcite-druid Maven
  Oct 9, 2020