org.apache.calcite.avatica:avatica-core vulnerabilities

CVEs whose affected-version data names the org.apache.calcite.avatica:avatica-core package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-70410High· 8.8

yesterday

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Calcite Avatica

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Calcite Avatica. Plugin instantiation (via AvaticaUtils#instantiatePlugin and other methods) initializes arbitrary classes via unr…

▾ TwilightApache Software Foundation · org.apache.calcite.avatica:avatica-corevia NVD