{"id":"CVE-2026-97849","aliases":[],"cve":{"records":[{"id":"CVE-2026-97849","source":"apache","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-25T06:24:27.578Z","published":"2026-11-10T15:36:31.310Z","modified":"2026-11-10T15:36:31.310Z"}],"publishers":[{"name":"apache","role":"CNA","organizationId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","modified":"2026-11-10T15:36:31.310Z"}],"references":[{"url":"https://lists.apache.org/thread/20fl5wnn3slxs0tq0ktmrc9xv9glffhq","tags":["vendor-advisory"],"source":"apache"}],"weaknesses":[{"id":"CWE-1327","description":"CWE-1327 Binding to an Unrestricted IP Address","source":"apache"}],"applicability":[],"prioritization":[]},"title":"Apache TomEE: Derby network service listens on all interfaces","titleSource":"apache","descriptionSource":"apache","description":"The embedded Derby network service ignores its configured bind address and listens on all network interfaces. When the service is enabled, a remote attacker with network access can connect to the database server and read or modify data. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.","score":null,"severity":"unknown","published":"2026-11-10T15:36:31.310Z","modified":"2026-11-10T15:36:31.310Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Apache Software Foundation","name":"Apache TomEE","platforms":[],"versions":[{"version":"4.0.0-beta-1","status":"affected","lessThanOrEqual":"4.7.5","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:maven/org.apache.openejb/openejb-derbynet","packageIdentity":{"ecosystem":"Maven","name":"org.apache.openejb:openejb-derbynet"},"cpes":[],"source":"apache","url":"https://www.cve.org/CVERecord?id=CVE-2026-97849"},{"vendor":"Apache Software Foundation","name":"Apache TomEE","platforms":[],"versions":[{"version":"7.0.0-M1","status":"affected","lessThan":"10.0.0-M1","versionType":"semver"},{"version":"10.0.0-M1","status":"affected","lessThan":"10.3.0","versionType":"semver"},{"version":"11.0.0-M1","status":"affected","lessThan":"11.0.0-M2","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:maven/org.apache.tomee/openejb-derbynet","packageIdentity":{"ecosystem":"Maven","name":"org.apache.tomee:openejb-derbynet"},"cpes":[],"source":"apache","url":"https://www.cve.org/CVERecord?id=CVE-2026-97849"}],"remediation":[],"references":["https://lists.apache.org/thread/20fl5wnn3slxs0tq0ktmrc9xv9glffhq"],"sources":[{"name":"CVE","id":"CVE-2026-97849","modified":"2026-11-10T15:36:31.310Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-97849"}],"assessments":[],"sourceAffected":[],"observedAt":"2026-11-10T15:46:14.489Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T21:25:33.720Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-11-10T15:50:34.223Z","attemptedAt":"2026-11-10T15:50:34.223Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-10T15:50:34.411Z","attemptedAt":"2026-11-10T15:50:34.411Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-10T15:50:33.803Z","attemptedAt":"2026-11-10T15:50:33.803Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-10T15:50:34.046Z","attemptedAt":"2026-11-10T15:50:34.046Z"}],"evidence":[],"aiSummary":{"text":"Apache TomEE's embedded Derby network service listens on all network interfaces, ignoring its configured bind address. A remote attacker with network access can connect to the database server and read or modify data in versions 4.0.0-beta-1 to 4.7.5, 7.0.0-M1 to less than 10.0.0-M1, 10.0.0-M1 to less than 10.3.0, and 11.0.0-M1 to less than 11.0.0-M2.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-10T15:51:14.404Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-97849"}]}}