---
id: "CVE-2026-86531"
page: "https://infrastack.ai/live/CVE-2026-86531"
kind: "vulnerability"
aliases: ["CVE-2026-86531"]
title: "OpenEJB: embedded HTTP server lets anyone exhaust memory and disk"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "org.apache.openejb:openejb-http", "fixed": [], "affected": ">= 4.0.0-beta-1, <= 4.7.5", "ecosystem": "maven"}, {"name": "org.apache.tomee:openejb-http", "fixed": [], "affected": ">= 7.0.0-M1, <= 10.2.0; 11.0.0-M1", "ecosystem": "maven"}]
ecosystems: []
tags: ["embedded-http", "java", "openejb", "package", "tomee"]
not_affected_if: ["network-restricted", "tomcat-connector"]
published_at: "2026-11-10T16:17:24+00:00"
first_seen_at: "2026-11-10T16:22:35+00:00"
updated_at: "2026-11-10T16:25:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86531", "first_seen_at": "2026-11-10T16:22:35+00:00"}, {"source": "analyst", "url": "https://tomee.apache.org/security/tomee.html", "first_seen_at": "2026-11-10T16:25:12+00:00", "cites": ["https://tomee.apache.org/security/tomee.html"]}]
exploit_sources: []
---

# OpenEJB: embedded HTTP server lets anyone exhaust memory and disk

Link for people: https://infrastack.ai/live/CVE-2026-86531 (this .md is for agents)

The embedded HTTP server in OpenEJB does not cap request body or multipart upload sizes and does not delete temporary files it creates for multipart parts. A remote unauthenticated attacker can exhaust memory or disk and cause a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:org.apache.openejb:openejb-http affected >= 4.0.0-beta-1, <= 4.7.5 fixed no fixed version listed
- maven:org.apache.tomee:openejb-http affected >= 7.0.0-M1, <= 10.2.0; 11.0.0-M1 fixed no fixed version listed

## How to check

- Check your dependencies for openejb-http (org.apache.openejb:openejb-http 4.0.0-beta-1 to 4.7.5; org.apache.tomee:openejb-http 7.0.0-M1 up to 10.2.0 excluding none; 11.0.0-M1), e.g. mvn dependency:tree | grep openejb-http.
- Check whether the app serves HTTP via OpenEJB's embedded server rather than Tomcat connectors (Tomcat-based TomEE is not affected).

## Fix

No patched openejb-http exists. Upgrade to Apache TomEE 10.3.0 or 11.0.0-M2, which remove the embedded OpenEJB HTTP server module. If you cannot upgrade, block network access to the embedded HTTP server from untrusted clients or stop using it.

## Timeline

- 2026-11-10T16:22:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-86531
- 2026-11-10T16:25:12+00:00 analyst https://tomee.apache.org/security/tomee.html — Read Apache TomEE security page: openejb-http module affected, no fixed version; module removed in TomEE 10.3.0 / 11.0.0-M2. Detail ranges via page fetch summary, not raw page (raw text truncated).

## Documents

- [advisory] Apache TomEE Security Vulnerabilities (fixed in 10.3.0 / 11.0.0-M2) https://tomee.apache.org/security/tomee.html

## From the sources

The embedded OpenEJB HTTP server does not limit the size of incoming request bodies or of multipart requests, and does not remove the temporary files it creates for multipart parts. A remote unauthenticated attacker can cause excessive memory or disk usage, leading to denial of service. Deployments using the Tomcat connectors are not affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_