{"id":"CVE-2026-86531","kind":"vulnerability","aliases":["CVE-2026-86531"],"related":[],"title":"OpenEJB: embedded HTTP server lets anyone exhaust memory and disk","description":"The embedded OpenEJB HTTP server does not limit the size of incoming request bodies or of multipart requests, and does not remove the temporary files it creates for multipart parts. A remote unauthenticated attacker can cause excessive memory or disk usage, leading to denial of service. Deployments using the Tomcat connectors are not affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.","summary":"The embedded HTTP server in OpenEJB does not cap request body or multipart upload sizes and does not delete temporary files it creates for multipart parts. A remote unauthenticated attacker can exhaust memory or disk and cause a denial of service.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"org.apache.openejb:openejb-http","fixed":[],"affected":">= 4.0.0-beta-1, <= 4.7.5","ecosystem":"maven"},{"name":"org.apache.tomee:openejb-http","fixed":[],"affected":">= 7.0.0-M1, <= 10.2.0; 11.0.0-M1","ecosystem":"maven"}],"ecosystems":[],"tags":["embedded-http","java","openejb","package","tomee"],"not_affected_if":["network-restricted","tomcat-connector"],"how_to_check":"- Check your dependencies for openejb-http (org.apache.openejb:openejb-http 4.0.0-beta-1 to 4.7.5; org.apache.tomee:openejb-http 7.0.0-M1 up to 10.2.0 excluding none; 11.0.0-M1), e.g. mvn dependency:tree | grep openejb-http.\n- Check whether the app serves HTTP via OpenEJB's embedded server rather than Tomcat connectors (Tomcat-based TomEE is not affected).","fix":"No patched openejb-http exists. Upgrade to Apache TomEE 10.3.0 or 11.0.0-M2, which remove the embedded OpenEJB HTTP server module. If you cannot upgrade, block network access to the embedded HTTP server from untrusted clients or stop using it.","status":"open","published_at":"2026-11-10T16:17:24+00:00","first_seen_at":"2026-11-10T16:22:35+00:00","triaged_at":"2026-11-10T16:23:59+00:00","updated_at":"2026-11-10T16:25:12+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-10T16:23:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"OpenEJB: embedded HTTP server lets anyone exhaust memory and disk","impact":"low","summary":"The embedded HTTP server in OpenEJB does not cap request body or multipart upload sizes and does not delete temporary files it creates for multipart parts. A remote unauthenticated attacker can exhaust memory or disk and cause a denial of service.","audience":"businesses","category":"package","nicknames":[],"who_cares":["openejb","tomee","java","embedded-http"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote attacker exhausts server memory and disk, causing denial of service","analyst_note":"Fixed versions and affected version ranges are not in the sources; check the NVD entry and the OpenEJB project advisory for them.","how_to_check":"- Check whether the application runs OpenEJB's embedded HTTP server rather than a Tomcat connector, for example by reviewing the server configuration.\n- Confirm which OpenEJB version is in use, for example `unknown` if the sources do not say which versions are affected.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["tomcat-connector","network-restricted"],"who_is_affected":"Deployments that serve HTTP through OpenEJB's embedded server are exposed, reachable by any network client that can send requests to it. Deployments using the Tomcat connectors are not affected according to the description. The sources recommend blocking network access to the embedded server from untrusted clients or moving to the Tomcat-based TomEE distributions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000754,"input_tokens":4606,"output_tokens":586,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Fixed versions and affected version ranges are not in the sources; check the NVD entry and the OpenEJB project advisory for them.","search":"'-2026':12A,15A '-86531':13A,16A 'access':133C 'affect':126C 'anyon':6A 'attack':61B,106C 'base':148C 'block':131C 'bodi':42B,86C 'cap':40B 'caus':68B,108C 'client':141C 'connector':123C 'creat':54B,99C 'cve':11A,14A 'delet':50B 'denial':70B,116C 'deploy':119C 'disk':10A,66B,112C 'distribut':150C 'embed':2A,26B,33B,74C,136C 'embedded-http':25B 'excess':109C 'exhaust':7A,63B 'file':52B,97C 'http':3A,20A,24A,27B,34B,76C,137C 'incom':84C 'java':28B 'lead':114C 'let':5A 'limit':80C 'memori':8A,64B,110C 'migrat':144C 'multipart':44B,56B,89C,101C 'network':132C 'openejb':1A,19A,23A,29B,37B,75C 'openejb-http':18A,22A 'org.apache.openejb':17A 'org.apache.tomee':21A 'packag':30B 'part':57B,102C 'recommend':129C 'remot':59B,104C 'remov':94C 'request':41B,85C,90C 'server':4A,35B,77C,138C 'servic':72B,118C 'size':46B,82C 'temporari':51B,96C 'tomcat':122C,147C 'tome':31B,149C 'unauthent':60B,105C 'untrust':140C 'upload':45B 'usag':113C 'use':120C 'user':127C","nicknames":[],"mitigations":[],"who_affected":"Apps that serve HTTP through OpenEJB's embedded HTTP server (openejb-http module) are exposed to any network client that can reach it, no login needed. Deployments using the Tomcat connectors (standard Apache TomEE) are not affected. Skip it if the embedded server is not reachable from untrusted clients.","tier":"B","verified":{"fix":{"at":"2026-11-10T16:25:12Z","by":"analyst","doc":"https://tomee.apache.org/security/tomee.html","run_id":2467},"mitigations":{"at":"2026-11-10T16:25:12Z","by":"analyst","doc":"https://tomee.apache.org/security/tomee.html","run_id":2467},"who_affected":{"at":"2026-11-10T16:25:12Z","by":"analyst","doc":"https://tomee.apache.org/security/tomee.html","run_id":2467}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["orgapacheopenejbopenejbhttp","orgapachetomeeopenejbhttp"],"ptokens":["apache","http","openejb","org","tomee"],"labels":["embeddedhttp","high","java","openejb","package","tomee"],"campaign_type":null,"search_a":"'-2026':12A,15A '-86531':13A,16A 'anyon':6A 'cve':11A,14A 'disk':10A 'embed':2A 'exhaust':7A 'http':3A,20A,24A 'let':5A 'memori':8A 'openejb':1A,19A,23A 'openejb-http':18A,22A 'org.apache.openejb':17A 'org.apache.tomee':21A 'server':4A","search_b":"'attack':61B 'bodi':42B 'cap':40B 'caus':68B 'creat':54B 'delet':50B 'denial':70B 'disk':66B 'embed':26B,33B 'embedded-http':25B 'exhaust':63B 'file':52B 'http':27B,34B 'java':28B 'memori':64B 'multipart':44B,56B 'openejb':29B,37B 'packag':30B 'part':57B 'remot':59B 'request':41B 'server':35B 'servic':72B 'size':46B 'temporari':51B 'tome':31B 'unauthent':60B 'upload':45B","search_c":"'access':133C 'affect':126C 'attack':106C 'base':148C 'block':131C 'bodi':86C 'caus':108C 'client':141C 'connector':123C 'creat':99C 'denial':116C 'deploy':119C 'disk':112C 'distribut':150C 'embed':74C,136C 'excess':109C 'file':97C 'http':76C,137C 'incom':84C 'lead':114C 'limit':80C 'memori':110C 'migrat':144C 'multipart':89C,101C 'network':132C 'openejb':75C 'part':102C 'recommend':129C 'remot':104C 'remov':94C 'request':85C,90C 'server':77C,138C 'servic':118C 'size':82C 'temporari':96C 'tomcat':122C,147C 'tome':149C 'unauthent':105C 'untrust':140C 'usag':113C 'use':120C 'user':127C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T16:17:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86531","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86531","severity":null,"published_at":"2026-11-10T16:17:24+00:00","modified_at":"2026-11-10T16:17:24+00:00","first_seen_at":"2026-11-10T16:22:35+00:00","fetched_at":"2026-11-10T16:22:35+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-86531:2467","url":"https://tomee.apache.org/security/tomee.html","severity":null,"published_at":"2026-11-10T16:25:12+00:00","modified_at":"2026-11-10T16:25:12+00:00","first_seen_at":"2026-11-10T16:25:12+00:00","fetched_at":"2026-11-10T16:25:12+00:00","note":"Read Apache TomEE security page: openejb-http module affected, no fixed version; module removed in TomEE 10.3.0 / 11.0.0-M2. Detail ranges via page fetch summary, not raw page (raw text truncated).","cites":["https://tomee.apache.org/security/tomee.html"]}],"documents":[{"id":116250,"url":"https://tomee.apache.org/security/tomee.html","title":"Apache TomEE Security Vulnerabilities (fixed in 10.3.0 / 11.0.0-M2)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}