CVE-2026-97881 · Package
NO FIX YET · SEE WHAT TO DO
The embedded HTTP server in OpenEJB does not limit static resource requests to its configured directories. A remote unauthenticated attacker can read any file the server process can access.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that run the embedded OpenEJB HTTP server and expose it to networks with untrusted clients are exposed. Systems that do not embed OpenEJB's HTTP server, or that keep it off untrusted networks, can skip it. The sources do not list affected versions.
Not affected if no-embedded-http-server, not-network-exposed
Who cares java, openejb, self-hosted
openejbThe embedded OpenEJB HTTP server does not restrict static resource paths to the configured resource directories. A remote unauthenticated attacker can read arbitrary files accessible to the server process. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.