OpenEJB HTTP Server Vulnerability in Multiple Web Applications

CVE-2026-111246

What is CVE-2026-111246?

The OpenEJB HTTP server fails to properly isolate HTTP sessions between different web applications hosted on the same server. This flaw allows a remote attacker to exploit session data from one web application within another, potentially leading to unauthorized access or manipulation of sensitive information. Affected installations are those where multiple web applications utilize the embedded HTTP server. Security protocols recommend restricting network access to this server from untrusted clients and consider migrating to the TomEE-based distributions for enhanced security measures.

References