How severe is CVE-2025-68637?

CVE-2025-68637 has a CVSS 3.x base score of 9.1, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.

Is CVE-2025-68637 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (12th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-68637?

CVE-2025-68637 affects Apache Uniffle. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-68637?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2025-68637 have an EU (EUVD) identifier?

Yes. CVE-2025-68637 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-1226.

When was CVE-2025-68637 published?

CVE-2025-68637 was published on 2026-01-07 and last updated on 2026-06-17.

CVE-2025-68637

CVE-2025-68637 is a critical-severity vulnerability in Apache Uniffle with a CVSS 3.x base score of 9.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-297.

Key facts

Severity: Critical (CVSS 3.x base score 9.1)
EPSS exploit prediction: 0% (12th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-1226
Weakness: CWE-297
Affected product: Apache Uniffle
Published: 2026-01-07
Last modified: 2026-06-17

Description

The Uniffle HTTP client is configured to trust all SSL certificates and disables hostname verification by default. This insecure configuration exposes all REST API communication between the Uniffle CLI/client and the Uniffle Coordinator service to potential Man-in-the-Middle (MITM) attacks. This issue affects all versions from before 0.10.0. Users are recommended to upgrade to version 0.10.0, which fixes the issue.

Frequently asked questions

What is CVE-2025-68637?: The Uniffle HTTP client is configured to trust all SSL certificates and disables hostname verification by default. This insecure configuration exposes all REST API communication between the Uniffle CLI/client and the Uniffle Coordinator service to potential Man-in-the-Middle (MITM) attacks. This issue affects all versions from before 0.10.0. Users are recommended to upgrade to version 0.10.0, which fixes the issue.
How severe is CVE-2025-68637?: CVE-2025-68637 has a CVSS 3.x base score of 9.1, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.
Is CVE-2025-68637 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (12th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-68637?: CVE-2025-68637 affects Apache Uniffle. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-68637?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2025-68637 have an EU (EUVD) identifier?: Yes. CVE-2025-68637 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-1226.
When was CVE-2025-68637 published?: CVE-2025-68637 was published on 2026-01-07 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:apache:uniffle:*:*:*:*:*:*:*:*

Other CWE-297 vulnerabilities

CVE-2025-46408 — Critical (CVSS 9.8): An issue was discovered in the methods push.lite.avtech.com.AvtechLib.GetHttpsResponse and…
CVE-2026-35563 — High (CVSS 8.5): It was identified that the LDAP client implementation in version 2.1.7 does not verify if the server certificate…
CVE-2025-3501 — High (CVSS 8.2): A flaw was found in Keycloak. By setting a verification policy to 'ALL', the trust store certificate verification is…
CVE-2025-2190 — High (CVSS 8.1): The mobile application (com.transsnet.store) has a man-in-the-middle attack vulnerability, which may lead to code…
CVE-2018-10936 — High (CVSS 8.1): A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check…
CVE-2026-54275 — High (CVSS 7.5): AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, the server_hostname…

Browse all CWE-297 vulnerabilities →