CVE-2026-97849 · Package
NO FIX YET · SEE WHAT TO DO
The embedded Derby network service ignores its configured bind address and listens on every network interface. A remote attacker with network access can connect to the database server and read or modify data.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that embed Derby and enable its network server are exposed, because the server ignores the configured bind address and accepts connections from any interface. Applications that use Derby only in embedded mode without the network server, or that block port access at the host or network level, are not exposed by this flaw.
Not affected if embedded-only, firewalled-port, network-server-disabled
Who cares apache-derby, java, self-hosted
NetworkServerControl or the Derby network server process).mvn dependency:tree | grep derby or check the Derby jar version in your build.ss -ltn | grep 1527.10.3.0 (or 11.0.0-M2 on the 11.x line).The embedded Derby network service ignores its configured bind address and listens on all network interfaces. When the service is enabled, a remote attacker with network access can connect to the database server and read or modify data. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.