Piotr P. Karwasz ppkarwasz

Threat Model: mod_perl 2.0

§1 Header

Project: mod_perl 2.0 (mod_perl2), embeds the Perl interpreter into Apache httpd
Version binding: 2.000014 (dev), commit ead5012b, 2024-02-06
Framework: potiuk gist da14a826283038ddfe38cc9fe6310573
Status: draft (simple), 0 maintainer review
Provenance legend: (documented) project docs/README · (maintainer) confirmed by maintainer · (inferred) reasoned from code, not yet verified
Confidence: ~6 documented / 0 maintainer / ~14 inferred

Apache ZooKeeper — Threat Model

Produced with the threat-model-producer skill (https://gist.github.com/potiuk/da14a826283038ddfe38cc9fe6310573). This is the implicit contract between ZooKeeper and its downstream operators/integrators: what is in scope, what is out, what the project claims, and what it disclaims. It is not an audit, a CVE list, or a secure-coding guide.

§1 Header

Apache HTTP Server 2.4.x — Threat Model

1. Header

Project: Apache HTTP Server (apache/httpd), branch 2.4.x
Repository commit basis: shallow clone of origin/2.4.x taken 2026-05-13
Date: 2026-05-13
Author: drafted by an external reviewer working from public artifacts; not yet ratified by the httpd PMC
Version binding: this document describes the implicit contract for the 2.4.x line as a whole. The release-stability policy in VERSIONING forbids breaking module API or runtime configuration within 2.4.x, so the threat model is expected to remain stable across patch releases. A report against a specific 2.4.<n> release should be triaged against this document as it stood at that tag.
Reporting cross-reference: vulnerabilities should be reported to security@httpd.apache.org per httpd.apache.org/security_report.html. Findings that fall under §3 or §9 of this document will be closed by reference to it.

Apache Log4j 2 — Threat Model

§4.1 Header

Project: Apache Log4j 2 (apache/logging-log4j2)
Version pinned: 2.26.0 (latest GA at time of writing; HEAD = 2.27.0-SNAPSHOT)
Java baseline: Java 17
Date: 2026-05-13
Author: drafted by the produce-threat-model skill in interview-first mode with a maintainer in the loop
Status: draft v1, under maintainer review

Apache Flume Threat Model

Project	Apache Flume (https://github.com/apache/logging-flume)
Version/commit	`main` @ `ff739dbe` (2024-10-10, "Announce dormant status"); latest release 1.11.0
Date	2026-05-13

	# CVEs in Apache Solr 9.9.0 build/runtime environment up to 2025-11-06 (release of 9.10.0)
	CVE-2016-1000027
	CVE-2020-29582
	CVE-2020-36518
	CVE-2020-8908
	CVE-2022-1471
	CVE-2022-24329
	CVE-2022-25857
	CVE-2022-38749
	CVE-2022-38750

	com.adobe.xmp:xmpcore:6.1.10
	com.beust:jcommander:1.82
	com.carrotsearch:hppc:0.10.0
	com.cybozu.labs:langdetect:1.1-20120112
	com.epam:parso:2.0.14
	com.fasterxml.jackson.core:jackson-annotations:2.18.0
	com.fasterxml.jackson.core:jackson-core:2.18.0
	com.fasterxml.jackson.core:jackson-databind:2.18.0
	com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:2.18.0
	com.fasterxml.jackson.dataformat:jackson-dataformat-csv:2.18.0

	===============================================================
	Name Type Delta New Old Suggest
	org.apache.logging.log4j.1.2.api BUNDLE MAJOR 2.22.1 1.2.17 -
	MAJOR BUNDLE log4j-1.2-api-2.22.1
	MAJOR API <api>
	MAJOR PACKAGE org.apache.log4j
	ADDED CLASS org.apache.log4j.AppenderSkeleton$NoOpErrorHandler
	ADDED ACCESS static
	ADDED IMPLEMENTS org.apache.log4j.spi.ErrorHandler
	ADDED METHOD <init>()

	/*
	* Add this annotation to the package:
	* @XmlSchema(xmlns = {
	* @XmlNs(prefix = "", namespaceURI = Example.NS1),
	* @XmlNs(prefix = "name2", namespaceURI = Example.NS2)}, elementFormDefault =
	* XmlNsForm.QUALIFIED)
	*/
	public class Example {

	@XmlType(namespace = XMLConstants.NULL_NS_URI)

	package pl.copernik.servlet;

	import java.io.IOException;
	import java.util.Collections;
	import java.util.Enumeration;
	import java.util.Map.Entry;
	import java.util.Objects;
	import java.util.TreeMap;
	import javax.servlet.ServletConfig;
	import javax.servlet.ServletContext;