{"id":"CVE-2026-111259","aliases":[],"cve":{"records":[{"id":"CVE-2026-111259","source":"apache","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-15T18:59:33.398Z","published":"2026-11-10T15:18:07.791Z","modified":"2026-11-10T15:18:07.791Z"}],"publishers":[{"name":"apache","role":"CNA","organizationId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","modified":"2026-11-10T15:18:07.791Z"}],"references":[{"url":"https://lists.apache.org/thread/1sk4193kxtf18q2so25c62c2b73o94lg","tags":["vendor-advisory"],"source":"apache"}],"weaknesses":[{"id":"CWE-338","description":"CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)","source":"apache"}],"applicability":[],"prioritization":[]},"title":"Apache TomEE: Predictable HTTP session identifiers in embedded server","titleSource":"apache","descriptionSource":"apache","description":"The embedded server generates HTTP session identifiers with a non-cryptographic random number generator by default. A remote attacker who observes a session identifier can predict the identifiers issued to other users and hijack their sessions, if the application relies on HTTP sessions for authentication. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","score":null,"severity":"unknown","published":"2026-11-10T15:18:07.791Z","modified":"2026-11-10T15:18:07.791Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Apache Software Foundation","name":"Apache TomEE","platforms":[],"versions":[{"version":"7.0.0-M1","status":"affected","lessThan":"10.0.0-M1","versionType":"semver"},{"version":"10.0.0-M1","status":"affected","lessThan":"10.3.0","versionType":"semver"},{"version":"11.0.0-M1","status":"affected","lessThan":"11.0.0-M2","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:maven/org.apache.tomee/tomee-embedded","packageIdentity":{"ecosystem":"Maven","name":"org.apache.tomee:tomee-embedded"},"cpes":[],"source":"apache","url":"https://www.cve.org/CVERecord?id=CVE-2026-111259"}],"remediation":[],"references":["https://lists.apache.org/thread/1sk4193kxtf18q2so25c62c2b73o94lg"],"sources":[{"name":"CVE","id":"CVE-2026-111259","modified":"2026-11-10T15:18:07.791Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-111259"}],"assessments":[],"sourceAffected":[],"observedAt":"2026-11-10T15:30:28.451Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:25:31.038Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"Apache TomEE's embedded server generates predictable HTTP session identifiers, allowing a remote attacker to hijack sessions if the application relies on HTTP sessions for authentication. Versions 7.0.0-M1 to 10.0.0-M1 and 10.0.0-M1 to 10.3.0 and 11.0.0-M1 to 11.0.0-M2 are affected. A non-cryptographic random number generator is used by default.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-10T15:36:10.779Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-111259"}]}}