CVE-2026-86531

Not scored yetLast modified Nov 12, 2026

Description

The embedded OpenEJB HTTP server does not limit the size of incoming request bodies or of multipart requests, and does not remove the temporary files it creates for multipart parts. A remote unauthenticated attacker can cause excessive memory or disk usage, leading to denial of service. Deployments using the Tomcat connectors are not affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.

Metrics

No CVSS score has been published yet.

Weakness enumeration

CWE-770

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Apache Software Foundation	Apache TomEE	>= 4.0.0-beta-1, <= 4.7.5
Apache Software Foundation	Apache TomEE	>= 7.0.0-M1, < 10.0.0-M1; >= 10.0.0-M1, <= 10.2.0; 11.0.0-M1

References

https://lists.apache.org/thread/cm1vdbx03ctl607nrrkdqyshwjscpd2y

Timeline

Published: Nov 10, 2026
Last modified: Nov 12, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-86532The bundled JAAS login modules leak whether a username exists and compare credentials in a non-constant-time manner. A remote unauthenticate CVE-2026-865339.1Insufficient Session Expiration vulnerability in team-alembic AshAuthentication and AshAuthentication Phoenix allows a revoked session to re CVE-2026-865358.7Loop with unreachable exit condition ('infinite loop'), Improperly controlled modification of object prototype attributes ('prototype pollut CVE-2026-865366.3Improperly controlled modification of object prototype attributes ('prototype pollution') vulnerability in Apache Thrift all JS bindings. CVE-2026-865378.7Uncaught exception, Loop with unreachable exit condition ('infinite loop'), Integer underflow (wrap or wraparound) vulnerability in Apache T CVE-2026-865387.5knowns versions before 0.30.0 contain a path traversal vulnerability in the POST /api/templates/preview endpoint that allows unauthenticated CVE-2026-865397.2knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbo CVE-2026-86548.7Improper input validation in Delphix Continuous Data connectors allows an authenticated user to execute arbitrary operating system commands CVE-2026-865407.8knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to CVE-2026-865418.3knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace() function that allows attackers to overwrite CVE-2026-865429.1knowns before 0.30.0 fails to validate import names in the import routes, allowing unauthenticated attackers to write files outside the impo CVE-2026-865439.8knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password require