CVE-2026-111251

Not scored yetLast modified Nov 12, 2026

Description

The admin service of the standalone OpenEJB server accepts stop requests without any authentication. Any local user or process able to connect to the admin port can stop the server, leading to denial of service; the admin service is enabled by default in the standalone server and bound to the loopback interface. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.

Metrics

No CVSS score has been published yet.

Weakness enumeration

CWE-306

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
Apache Software FoundationApache TomEE>= 4.0.0-beta-1, <= 4.7.5
Apache Software FoundationApache TomEE>= 7.0.0-M1, < 10.0.0-M1; >= 10.0.0-M1, < 10.3.0; >= 11.0.0-M1, < 11.0.0-M2

References

Timeline

Published
Nov 10, 2026
Last modified
Nov 12, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1112526.5A denial of service vulnerability exists in the XML parsing of multiple versions of OpenNMS Meridian and Horizon. OpenNMS parsed XML withoutCVE-2026-1112536.6A flaw was found in dnf5daemon-server. Session methods on dynamically exported D-Bus session objects do not verify that the caller is the unCVE-2026-1112547.2The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and CVE-2026-1112557.5The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Arbitrary File Upload in all CVE-2026-111256When JAX-WS or JAX-RS endpoints are published by the embedded OpenEJB HTTP server rather than Tomcat, some configured authentication methodsCVE-2026-111257With the default configuration and no users defined in the default user database, TomEE silently adds an administrative user with a well-knoCVE-2026-111258The optional request routing feature forwards requests to their configured destination without applying the security constraints of that desCVE-2026-111259The embedded server generates HTTP session identifiers with a non-cryptographic random number generator by default. A remote attacker who obCVE-2026-111264.3Inappropriate implementation in DevTools in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicCVE-2026-111260The Jakarta Security OpenID Connect authentication mechanism generates the state and nonce values with a non-cryptographic random number genCVE-2026-111261The Jakarta Security LDAP identity store accepts an empty password as valid if the directory server allows unauthenticated binds, which someCVE-2026-111262The Jakarta Security LDAP identity store does not neutralize special characters in the caller name before using it in directory queries. A r
CVE-2026-111251: Unscored | Vulnix