products / apache_derby

Apache Derby

Apache Derby is a Java embedded RDBMS. NVD tracks it as apache:derby. CVE volume is smaller than server-class databases, but NVD maintains a consistent advisory history for the apache:derby namespace.

api usage

Querying Apache Derby

product slugapache_derby

version format10.11.1.1, 10.15.2.0

bash

curl "https://api.attestd.io/v1/check?product=apache_derby&version=10.11.1.1" \
  -H "Authorization: Bearer $ATTESTD_KEY"

Example targets CVE-2015-1832 (XML external entity / SQL injection class issues in older lines). Verify risk_state after synthesis. Embedded engines often skew toward local attack vectors.

json

{
  "product": "apache_derby",
  "version": "10.11.1.1",
  "supported": true,
  "risk_state": "critical",
  "risk_factors": [
    "remote_code_execution",
    "no_authentication_required",
    "internet_exposed_service",
    "patch_available"
  ],
  "actively_exploited": false,
  "remote_exploitable": true,
  "authentication_required": false,
  "patch_available": true,
  "fixed_version": "10.15.0.0",
  "confidence": 0.85,
  "cve_ids": [
    "CVE-2015-1832",
    "CVE-2018-1313",
    "CVE-2022-46337"
  ],
  "cves": null,
  "max_epss": 0.12173,
  "last_updated": "2026-07-26T06:26:17.981342Z",
  "supply_chain": null,
  "supply_chain_monitored": false,
  "typosquat": null
}

cleaner line

Newer release

bash

curl "https://api.attestd.io/v1/check?product=apache_derby&version=10.17.1.0" \
  -H "Authorization: Bearer $ATTESTD_KEY"

notable cves

CVE history

CVE	Description	Affects	CVSS
`CVE-2015-1832`	XML external entity and SQL injection vectors in Derby network server.	before 10.12.1.2	7.5
`CVE-2009-4269`	Insufficient path validation in Derby tools.	10.5 and prior	5.0
`CVE-2018-1313`	Derby network server denial of service.	10.14.x	5.9
`CVE-2016-0739`	Information disclosure via error messages.	10.11–10.12	5.3
`CVE-2010-2232`	Access control weakness in embedded deployment modes.	10.6	4.0

All products SQLite PostgreSQL