Threats affecting pkg:maven/org.apache.openejb/openejb-http

Apache TomEE's embedded OpenEJB HTTP server does not limit the size of incoming request bodies or multipart requests and fails to remove temporary files created for multipart parts. This can allow a remote unauthenticated attacker to cause excessive memory or disk usage, resulting in denial of service. Deployments using Tomcat connectors are not affected. Users are advised to block network access to the embedded HTTP server from untrusted clients or migrate to Tomcat-based TomEE distributions.

CVE-2026-97880 is an improper authentication vulnerability in Apache TomEE's embedded OpenEJB HTTP server. The server dispatches some requests to REST endpoints configured for HTTP Basic authentication without verifying credentials, allowing remote unauthenticated attackers to bypass authentication and invoke protected resources. This affects only deployments using the embedded HTTP server with Basic authentication. Users are advised to block network access to the embedded HTTP server from untrusted clients or migrate to Tomcat-based TomEE distributions.

Apache TomEE's embedded OpenEJB HTTP server does not properly isolate HTTP sessions between multiple web applications hosted on it. This allows a remote attacker to reuse a session established in one web application in another, potentially causing one application to trust session state set by another. This issue affects deployments running several web applications on the embedded HTTP server. Users are advised to block untrusted network access to the embedded HTTP server or migrate to TomEE distributions based on Tomcat.

CVE-2026-111250 is an improper authentication vulnerability in Apache TomEE's embedded OpenEJB HTTP server. The server incorrectly reports every request as authenticated when an application requests authentication programmatically, allowing remote unauthenticated attackers to access protected functionality. This affects only applications served by the embedded HTTP server that rely on programmatic authentication. Users are advised to block network access to the embedded HTTP server from untrusted clients or migrate to Tomcat-based TomEE distributions.