CVE-2024-39954 Apache EventMesh Runtime: SSRF
An attacker can exploit Server-Side Request Forgery in Apache EventMesh Runtime to read or update internal server resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-39954?
CVE-2024-39954 is a medium-severity server-side request forgery vulnerability in Apache EventMesh Runtime, published on 20 Aug 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
CWE-918 Server-Side Request Forgery (SSRF) in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. allows the attacker can abuse functionality on the server to read or update internal resources. Users are recommended to upgrade to version 1.12.0 or use the master branch , which fixes this issue.
Weakness: CWE-918
Which versions are affected by CVE-2024-39954?
2 open source packages ship an affected version, including org.apache.eventmesh:eventmesh-runtime. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.eventmesh:eventmesh-runtime Maven | From 1.6.0-release to 1.11.0-release | None |
org.apache.eventmesh:eventmesh-runtime Maven | From 1.6.0-release to 1.11.0-release | None |
Products include Apache Eventmesh.
How do I fix CVE-2024-39954?
No fix has been published for CVE-2024-39954 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2024-39954 being exploited?
There is no known exploitation of CVE-2024-39954 in the wild and no public exploit code.
Other vulnerabilities in Apache EventMesh Runtime
Sources
Also known as GHSA-hf86-8x8v-h7vc.