{"id":"CVE-2026-97849","kind":"vulnerability","aliases":["CVE-2026-97849"],"related":[],"title":"Apache Derby: embedded network server listens on all interfaces, ignoring bind address","description":"The embedded Derby network service ignores its configured bind address and listens on all network interfaces. When the service is enabled, a remote attacker with network access can connect to the database server and read or modify data. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","summary":"The embedded Derby network service ignores its configured bind address and listens on every network interface. A remote attacker with network access can connect to the database server and read or modify data.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-derby","java","package","self-hosted"],"not_affected_if":["embedded-only","firewalled-port","network-server-disabled"],"how_to_check":"- Check whether the Derby network server is enabled in the application configuration (look for a running `NetworkServerControl` or the Derby network server process).\n- Confirm the Derby version in your dependency tree, for example `mvn dependency:tree | grep derby` or check the Derby jar version in your build.\n- Check whether the listening port (default 1527) is reachable from other hosts, for example with `ss -ltn | grep 1527`.","fix":"- Upgrade Apache Derby to `10.3.0` (or `11.0.0-M2` on the 11.x line).","status":"open","published_at":"2026-11-10T16:17:25+00:00","first_seen_at":"2026-11-10T16:22:35+00:00","triaged_at":"2026-11-10T16:24:02+00:00","updated_at":"2026-11-10T16:24:02+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-10T16:24:02Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache Derby to `10.3.0` (or `11.0.0-M2` on the 11.x line).","reach":"network","title":"Apache Derby: embedded network server listens on all interfaces, ignoring bind address","impact":"high","summary":"The embedded Derby network service ignores its configured bind address and listens on every network interface. A remote attacker with network access can connect to the database server and read or modify data.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","apache-derby","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"remote attacker reads or modifies database data","analyst_note":"","how_to_check":"- Check whether the Derby network server is enabled in the application configuration (look for a running `NetworkServerControl` or the Derby network server process).\n- Confirm the Derby version in your dependency tree, for example `mvn dependency:tree | grep derby` or check the Derby jar version in your build.\n- Check whether the listening port (default 1527) is reachable from other hosts, for example with `ss -ltn | grep 1527`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["embedded-only","network-server-disabled","firewalled-port"],"who_is_affected":"Applications that embed Derby and enable its network server are exposed, because the server ignores the configured bind address and accepts connections from any interface. Applications that use Derby only in embedded mode without the network server, or that block port access at the host or network level, are not exposed by this flaw.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.00074,"input_tokens":4534,"output_tokens":573,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-97849':15A,18A '10.3.0':105C '11.0.0':107C 'access':48B,86C 'address':12A,36B,69C 'apach':1A,20B 'apache-derbi':19B 'attack':45B,83C 'bind':11A,35B,68C 'configur':34B,67C 'connect':50B,88C 'cve':13A,16A 'data':59B,97C 'databas':53B,91C 'derbi':2A,21B,29B,62C 'embed':3A,28B,61C 'enabl':80C 'everi':40B 'fix':110C 'host':26B 'ignor':10A,32B,65C 'interfac':9A,42B,75C 'issu':112C 'java':22B 'listen':6A,38B,71C 'm2':108C 'modifi':58B,96C 'network':4A,30B,41B,47B,63C,74C,85C 'packag':23B 'read':56B,94C 'recommend':100C 'remot':44B,82C 'self':25B 'self-host':24B 'server':5A,54B,92C 'servic':31B,64C,78C 'upgrad':102C 'user':98C 'version':104C","nicknames":[],"mitigations":[],"who_affected":"Applications that embed Derby and enable its network server are exposed, because the server ignores the configured bind address and accepts connections from any interface. Applications that use Derby only in embedded mode without the network server, or that block port access at the host or network level, are not exposed by this flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apachederby","java","package","selfhosted","unknown"],"campaign_type":null,"search_a":"'-2026':14A,17A '-97849':15A,18A 'address':12A 'apach':1A 'bind':11A 'cve':13A,16A 'derbi':2A 'embed':3A 'ignor':10A 'interfac':9A 'listen':6A 'network':4A 'server':5A","search_b":"'access':48B 'address':36B 'apach':20B 'apache-derbi':19B 'attack':45B 'bind':35B 'configur':34B 'connect':50B 'data':59B 'databas':53B 'derbi':21B,29B 'embed':28B 'everi':40B 'host':26B 'ignor':32B 'interfac':42B 'java':22B 'listen':38B 'modifi':58B 'network':30B,41B,47B 'packag':23B 'read':56B 'remot':44B 'self':25B 'self-host':24B 'server':54B 'servic':31B","search_c":"'10.3.0':105C '11.0.0':107C 'access':86C 'address':69C 'attack':83C 'bind':68C 'configur':67C 'connect':88C 'data':97C 'databas':91C 'derbi':62C 'embed':61C 'enabl':80C 'fix':110C 'ignor':65C 'interfac':75C 'issu':112C 'listen':71C 'm2':108C 'modifi':96C 'network':63C,74C,85C 'read':94C 'recommend':100C 'remot':82C 'server':92C 'servic':64C,78C 'upgrad':102C 'user':98C 'version':104C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T16:17:25+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97849","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97849","severity":null,"published_at":"2026-11-10T16:17:25+00:00","modified_at":"2026-11-10T16:17:25+00:00","first_seen_at":"2026-11-10T16:22:35+00:00","fetched_at":"2026-11-10T16:22:35+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}