APISIX ↗

Apache · Actively exploited

Track your version:Monitors APISIX and tailors your dashboard to that exact version.

3.19.0 · latest cycle100/100 Healthy

Auto-added after CISA flagged APISIX as actively exploited (KEV catalog). Version and lifecycle mapping is pending review, so this is assessed at the product level and is never reported as a confident "healthy".

Summary iPlain-English security verdict for APISIX, generated from its current health score, actively-exploited vulnerabilities, and latest supported version.

APISIX currently scores 100/100 — healthy. 2 actively-exploited vulnerabilities (CISA KEV) affect older releases (e.g. CVE-2023-44487) — staying on the latest supported version keeps you clear of them. The latest supported release is 3.19.0. It's on the latest patch with no significant known issues — keep it current.

Disclosure trend iNew CVEs published for APISIX each year (NVD). A higher bar means more disclosures that year — more scrutiny, not necessarily less safe.

'19

'20

'21

'22

'23

'24

'25

'26

Patch priority — what to act on iThe issues to fix first — actively exploited (CISA KEV) first, then by exploitation probability (EPSS), then severity. Each row's "→ fixed in" is the earliest version that patches it; "see advisory" means no fixed version is published.

Most urgent first — actively exploited, then likeliest to be exploited.

CVE-2023-44487 HIGH exploited Uncontrolled resource consumption EPSS 100% → fixed in 3.6.1 CVE-2022-24112 CRITICAL exploited CWE-290 EPSS 96% → fixed in 2.12.1 CVE-2020-13945 MEDIUM EPSS 73% → see advisory CVE-2022-25757 CRITICAL Improper input validation EPSS 2% → fixed in 2.13.0 CVE-2026-39999 CRITICAL CWE-290 EPSS 1% → fixed in 3.17.0 CVE-2026-31908 CRITICAL CWE-75 EPSS 1% → fixed in 3.16.0 CVE-2026-49871 CRITICAL Cross-site request forgery (CSRF) EPSS 0% → fixed in 3.17.0 CVE-2026-49230 CRITICAL CWE-354 EPSS 0% → fixed in 3.17.0 CVE-2026-44087 CRITICAL CWE-345 EPSS 0% → fixed in 3.17.0

See all 29 known APISIX CVEs & security history →

Get alerted about APISIX

Be emailed the moment APISIX gets a newly exploited vulnerability (CISA KEV) or a release reaches end of life. Free · double opt-in · unsubscribe anytime.

We email only on real events for APISIX — no marketing, no sharing, and we never know what you run. Track your whole stack →

Versions & lifecycle iWhen each release line stops receiving security patches (end-of-life). After EOL there are no more fixes — plan upgrades before these dates.

How long each APISIX release line is supported — and when it sunsets. Select a line for its full report.

Sept28'26 APISIX 3.18ended 2026-09-28

Aug20'26 APISIX 3.17ended 2026-08-20

Jun16'26 APISIX 3.16ended 2026-06-16

Apr8'26 APISIX 3.15ended 2026-04-08

Feb5'26 APISIX 3.14ended 2026-02-05

Oct10'25 APISIX 3.13ended 2025-10-10

Jun27'25 APISIX 3.12ended 2025-06-27

Apr1'25 APISIX 3.11ended 2025-04-01

Nov13'24 APISIX 3.2ended 2024-11-13

Oct17'24 APISIX 3.10ended 2024-10-17

Aug14'24 APISIX 3.9ended 2024-08-14

Mar20'24 APISIX 3.8ended 2024-03-20

Full APISIX end-of-life dates & support timeline →

Frequently asked

Is APISIX safe and patched?

What should I do about APISIX now?

Upgrade APISIX to the latest supported release (3.19.0) or later, which clears the actively-exploited issues affecting older versions, then confirm against Apache's official advisory.

Why is APISIX listed on IsItPatched?

APISIX was added automatically because CISA's Known Exploited Vulnerabilities (KEV) catalog flagged it as actively exploited in the wild. IsItPatched tracks its known CVEs, severity (CVSS), exploitation probability (EPSS) and KEV status from public data; its version and lifecycle mapping is verified over time.

Has APISIX been actively exploited?

Yes. CISA added APISIX to its Known Exploited Vulnerabilities (KEV) catalog after confirming exploitation in the wild — the triggering vulnerability is CVE-2022-24112. Make sure you are running a patched, supported version of APISIX and confirm it against Apache's security advisory.

When does APISIX reach end-of-life?

The latest supported APISIX release is 3.19.0. After end-of-life a release no longer receives security patches.

Which versions of APISIX are still receiving security updates?

Supported APISIX release lines (latest 3.19.0): 3.19. End-of-life releases no longer receive security patches.

Similar software we track

More from Apache tracked on IsItPatched.

ActiveMQ Apache Airflow Apache Camel Apache Cassandra Apache Druid Apache Hadoop Apache HBase Apache Hive

Informational only, from public data (NVD · CISA KEV · EPSS · endoflife.date), and can lag or miss vendor-specific fixes. Always confirm against Apache's official advisory before you patch or upgrade — APISIX official site ↗