Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

Apache Druid core can be tampered via prototype pollution

CVE-2021-26920 · published 2 years ago
Summary

The Druid core component uses the fast-xml-parser library, which before version 4.1.2 lets attackers insert a special "__proto__" field. This can silently change how the software works and potentially let an attacker control it. Upgrade the fast-xml-parser library to version 4.1.2 or newer, or apply the vendor's recommended patch, to stop the risk.

What to do
  • Update apache org.apache.druid:druid-core to version 0.21.0.
  • Update apache druid to version 0.22.0 or later.
Affected software
Ecosystem VendorProductAffected versions
maven apache org.apache.druid:druid-core < 0.21.0
Fix: upgrade to 0.21.0
– apache druid < 0.22.0
cpe:2.3:a:apache:druid:*:*:*:*:*:*:*:*
Original advisory text
fast-xml-parser before 4.1.2 allows __proto__ for Prototype Pollution.
fast-xml-parser before 4.1.2 allows __proto__ for Prototype Pollution.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.5 Medium
Exploitation
9% chance of attack within 30 days
Type
CWE-863Incorrect Authorization
CWE-610Externally Controlled Reference to a Resource in Another Sphere
CWE-1321Prototype Pollution
Timeline
Published12 Dec 2023
Updated21 Oct 2026
First seen6 Mar 2026
Sources
GHSA-793h-6f7r-6qvm · GHSA
CVE-2021-26920 · NVD
CVE-2021-26920 · OSV
CVE-2023-26920 · OSV
Track software like this
Free during beta