What’s Vulnerable › Vulnerabilities
CVE-2024-39954: Apache EventMesh Runtime: SSRF
- Severity: medium (CVSS 6.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-08-20 · updated 2026-06-17
- Weakness: CWE-918
Description
CWE-918 Server-Side Request Forgery (SSRF) in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. allows the attacker can abuse functionality on the server to read or update internal resources. Users are recommended to upgrade to version 1.12.0 or use the master branch , which fixes this issue.
Affected products
- Apache Software Foundation Apache EventMesh: before 1.12.0 — fixed in 1.12.0
How to fix
Upgrade to a fixed version: Apache Software Foundation Apache EventMesh 1.12.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-39954 or the next vulnerability affects your stack