CVE-2024-39954

CVE-2024-39954: Apache EventMesh Runtime: SSRF

Vendor Apache Software Foundation
Product Apache EventMesh Runtime
Weakness CWE-918 · SSRF
Published August 20, 2025
Last update August 20, 2025

CVSS base score

What the vulnerability does

Description

CWE-918 Server-Side Request Forgery (SSRF) in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. allows the attacker can abuse functionality on the server to read or update internal resources. Users are recommended to upgrade to version 1.12.0 or use the master branch , which fixes this issue.

Key dates

Disclosure timeline

August 20, 2025 CVE published
August 20, 2025 Record updated