Threats affecting pkg:maven/org.apache.tomee/openejb-http

Apache TomEE's embedded OpenEJB HTTP server does not limit the size of incoming request bodies or multipart requests and fails to remove temporary files created for multipart parts. This can allow a remote unauthenticated attacker to cause excessive memory or disk usage, resulting in denial of service. Deployments using Tomcat connectors are not affected. Users are advised to block network access to the embedded HTTP server from untrusted clients or migrate to Tomcat-based TomEE distributions.

CVE-2026-97880 is an improper authentication vulnerability in Apache TomEE's embedded OpenEJB HTTP server. The server dispatches some requests to REST endpoints configured for HTTP Basic authentication without verifying credentials, allowing remote unauthenticated attackers to bypass authentication and invoke protected resources. This affects only deployments using the embedded HTTP server with Basic authentication. Users are advised to block network access to the embedded HTTP server from untrusted clients or migrate to Tomcat-based TomEE distributions.

CVE-2026-97881 is a path traversal vulnerability in the embedded OpenEJB HTTP server component of Apache TomEE. This flaw allows a remote unauthenticated attacker to read arbitrary files accessible to the server process by exploiting insufficient restrictions on static resource paths. Users are advised to block network access to the embedded HTTP server from untrusted clients or migrate to Tomcat-based TomEE distributions. The vulnerability affects multiple versions of Apache TomEE prior to 10.0.0-M1, with fixes available starting from 10.0.0-M1.

Apache TomEE's embedded HTTP server does not clear the security identity between requests, allowing a remote unauthenticated attacker to have their request processed with the privileges of a previously authenticated user. This affects applications using programmatic or basic authentication with the embedded server. Users are advised to block untrusted network access or migrate to Tomcat-based TomEE distributions.

Apache TomEE's embedded HTTP server does not invalidate the previous session identifier when the session ID changes, such as after user login. This session fixation vulnerability allows an attacker who can set a session ID in a victim's browser to hijack the victim's authenticated session. Users are advised to restrict network access to the embedded HTTP server from untrusted clients or migrate to Tomcat-based TomEE distributions.

Apache TomEE's embedded OpenEJB HTTP server does not properly isolate HTTP sessions between multiple web applications hosted on it. This allows a remote attacker to reuse a session established in one web application in another, potentially causing one application to trust session state set by another. This issue affects deployments running several web applications on the embedded HTTP server. Users are advised to block untrusted network access to the embedded HTTP server or migrate to TomEE distributions based on Tomcat.

CVE-2026-111250 is an improper authentication vulnerability in Apache TomEE's embedded OpenEJB HTTP server. The server incorrectly reports every request as authenticated when an application requests authentication programmatically, allowing remote unauthenticated attackers to access protected functionality. This affects only applications served by the embedded HTTP server that rely on programmatic authentication. Users are advised to block network access to the embedded HTTP server from untrusted clients or migrate to Tomcat-based TomEE distributions.