CVE-2026-94250

Last refreshed2026-10-03

Status: UPDATED | Advisory ID: CVE-2026-94250

Key Details

CVE	CVE-2026-94250
CVSS Score / Version	8.2 (High) / CVSS v4.0
Updated	2026-10-01
Affected products	Apache Software Foundation Apache APISIX
Classified as	CWE-770 (Allocation of Resources Without Limits or Throttling)

Affected Products, Subsystems & Sectors

Vendor	Product	Affected Versions	Patch Status
Apache Software Foundation	Apache APISIX

Vendor

Product

Affected Versions

Patch Status

Apache Software Foundation

Apache APISIX

Subsystems	General OT
Sectors	Multiple

What to Know

Allocation of resources without limits or throttling vulnerability in batch-requests plugin in Apache APISIX.

An unauthenticated caller can drive a gateway worker into OOM via a route where the batch-requests plugin is used and the batch endpoint is publicly exposed. This issue affects Apache APISIX: from 1.3.0 through 3.18.0.

Users are recommended to upgrade to version 3.19.0, which fixes the issue. (NVD)

What to Do

Monitor Apache Software Foundation's web page for any future patch releases.

References

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-94250
CVE	https://www.cve.org/CVERecord?id=CVE-2026-94250

Source

Reference

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-94250

CVE