Synced 07 Nov 2026 15:45 UTC Account

Is APISIX 3.5.0 patched?

Apache · cycle 3.5 · end of life
3.5.00/100Critical · exploited

Current stable (3.19.0): 100/100

Minimum safe version3.18.0

3.5.0 has 13 open critical-or-high vulnerabilities. Run 3.18.0 or later to clear them. See what 3.18.0 fixes →

Upgrade impact: Minor upgrade. Minor releases are usually backwards-compatible, but can add or change behaviour — test in staging before production.

Health score0/100
Open issues18
Exploited now1
Cycle 3.5 EOL2023-10-01
Latest release3.19.0

Summary iPlain-English security status for APISIX 3.5.0, built from its CVEs, active-exploitation data, end-of-life date and latest release.

APISIX 3.5.0 is part of the 3.5 release line. 1 actively-exploited vulnerability affects it (CISA KEV). The minimum safe version is 3.18.0 — upgrade to it or later to clear the open critical/high issues. The 3.5 line reached end-of-life on 2023-10-01, so it no longer receives security patches. The latest supported APISIX release is 3.19.0.

Known issues affecting 3.5.0

Exploited first, then by exploitation probability.

CVE-2023-44487 HIGH exploited EPSS 100% → fixed in 3.6.1 CVE-2026-39998 HIGH EPSS 1% → fixed in 3.17.0 CVE-2026-48895 HIGH EPSS 1% → fixed in 3.17.0 CVE-2026-44915 MEDIUM EPSS 1% → fixed in 3.17.0 CVE-2026-39999 CRITICAL EPSS 1% → fixed in 3.17.0 CVE-2026-74848 HIGH EPSS 1% → fixed in 3.18.0 CVE-2026-49231 MEDIUM EPSS 1% → fixed in 3.17.0 CVE-2026-75020 HIGH EPSS 1% → fixed in 3.18.0 CVE-2026-49872 HIGH EPSS 1% → fixed in 3.17.0 CVE-2026-31908 CRITICAL EPSS 1% → fixed in 3.16.0 CVE-2025-46647 MEDIUM EPSS 0% → fixed in 3.12.0 CVE-2025-62232 HIGH EPSS 0% → fixed in 3.14.0 CVE-2026-44046 MEDIUM EPSS 0% → fixed in 3.17.0 CVE-2026-47339 HIGH EPSS 0% → fixed in 3.17.0 CVE-2026-49871 CRITICAL EPSS 0% → fixed in 3.17.0 CVE-2026-44087 CRITICAL EPSS 0% → fixed in 3.17.0 CVE-2026-31923 HIGH EPSS 0% → fixed in 3.16.0 CVE-2026-31924 MEDIUM EPSS 0% → fixed in 3.16.0

Other APISIX versions

Check another release line of APISIX.

APISIX 3.19.0APISIX 3.18.0APISIX 3.17.0APISIX 3.16.0APISIX 3.15.0APISIX 3.14.1APISIX 3.13.0APISIX 3.12.0APISIX 3.11.0APISIX 3.10.0APISIX 3.9.1APISIX 3.8.1APISIX 3.7.0APISIX 3.6.0APISIX 3.4.1APISIX 3.3.0APISIX 3.2.2APISIX 3.1.0APISIX 3.0.0APISIX 2.15.3APISIX 2.14.1APISIX 2.13.3APISIX 2.12.1APISIX 2.11.0APISIX 2.10.5

Frequently asked

Is APISIX 3.5.0 patched?

No — 1 actively-exploited vulnerability affects APISIX 3.5.0. Upgrade to at least 3.18.0.

What version should I upgrade APISIX 3.5.0 to?

Upgrade APISIX 3.5.0 to at least 3.18.0 to clear its 13 open critical-or-high vulnerabilities.

When does APISIX 3.5 reach end-of-life?

APISIX 3.5 reached end-of-life on 2023-10-01 and no longer receives security patches.

What is the latest version of APISIX?

The latest supported APISIX release is 3.19.0.

Is APISIX 3.5.0 still receiving security updates?

No — APISIX 3.5.0 is on the 3.5 line, which reached end-of-life on 2023-10-01 and no longer receives security updates. Upgrade to 3.19.0 or later to stay supported.

Informational only, from public data (NVD · CISA KEV · EPSS · endoflife.date), and can lag or miss vendor-specific fixes. Always confirm against Apache's official advisory before you patch or upgrade.