{"id":"CVE-2026-111246","aliases":[],"cve":{"records":[{"id":"CVE-2026-111246","source":"apache","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-15T18:36:38.645Z","published":"2026-11-10T15:23:45.682Z","modified":"2026-11-10T15:23:45.682Z"}],"publishers":[{"name":"apache","role":"CNA","organizationId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","modified":"2026-11-10T15:23:45.682Z"}],"references":[{"url":"https://lists.apache.org/thread/3l9twg2ywvgwjffv4wwop2fmtp05fp39","tags":["vendor-advisory"],"source":"apache"}],"weaknesses":[{"id":"CWE-668","description":"CWE-668 Exposure of Resource to Wrong Sphere","source":"apache"}],"applicability":[],"prioritization":[]},"title":"Apache TomEE: HTTP sessions shared across web applications in embedded HTTP server","titleSource":"apache","descriptionSource":"apache","description":"The embedded OpenEJB HTTP server does not isolate HTTP sessions between web applications. A remote attacker can use a session established in one web application in another one, which then trusts session state set by the first application. Only deployments hosting several web applications on the embedded HTTP server are affected. Users are recommended to block network access to the embedded HTTP server from untrusted clients, or to migrate to the Tomcat based TomEE distributions.","score":null,"severity":"unknown","published":"2026-11-10T15:23:45.682Z","modified":"2026-11-10T15:23:45.682Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Apache Software Foundation","name":"Apache TomEE","platforms":[],"versions":[{"version":"4.5.2","status":"affected","lessThanOrEqual":"4.7.5","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:maven/org.apache.openejb/openejb-http","packageIdentity":{"ecosystem":"Maven","name":"org.apache.openejb:openejb-http"},"cpes":[],"source":"apache","url":"https://www.cve.org/CVERecord?id=CVE-2026-111246"},{"vendor":"Apache Software Foundation","name":"Apache TomEE","platforms":[],"versions":[{"version":"7.0.0-M1","status":"affected","lessThan":"10.0.0-M1","versionType":"semver"},{"version":"10.0.0-M1","status":"affected","lessThanOrEqual":"10.2.0","versionType":"semver"},{"version":"11.0.0-M1","status":"affected","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:maven/org.apache.tomee/openejb-http","packageIdentity":{"ecosystem":"Maven","name":"org.apache.tomee:openejb-http"},"cpes":[],"source":"apache","url":"https://www.cve.org/CVERecord?id=CVE-2026-111246"}],"remediation":[],"references":["https://lists.apache.org/thread/3l9twg2ywvgwjffv4wwop2fmtp05fp39"],"sources":[{"name":"CVE","id":"CVE-2026-111246","modified":"2026-11-10T15:23:45.682Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-111246"}],"assessments":[],"sourceAffected":[],"observedAt":"2026-11-10T15:29:57.255Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T01:25:32.844Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-11-10T15:30:36.184Z","attemptedAt":"2026-11-10T15:30:36.184Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-10T15:30:36.618Z","attemptedAt":"2026-11-10T15:30:36.618Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-10T15:30:36.189Z","attemptedAt":"2026-11-10T15:30:36.189Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-10T15:30:36.016Z","attemptedAt":"2026-11-10T15:30:36.016Z"}],"evidence":[],"aiSummary":{"text":"Apache TomEE's embedded HTTP server shares HTTP sessions across web applications, allowing a remote attacker to use a session from one application in another. This affects deployments with multiple web applications on the embedded server, specifically versions 4.5.2 to 4.7.5, 7.0.0-M1 to 10.0.0-M1, and 11.0.0-M1. A remote attacker can exploit this weakness.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-10T15:31:05.834Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-111246"}]}}