Denial of Service Vulnerability in OpenEJB HTTP Server by Apache

CVE-2026-86531

What is CVE-2026-86531?

The Apache OpenEJB HTTP server has a critical flaw that allows remote unauthenticated attackers to exploit limitations in request body size management. This oversight can lead to excessive memory or disk usage, resulting in a denial of service for the affected deployments. The embedded server fails to properly handle multipart requests, retaining temporary files without removing them afterward. It is advised that users restricting network access to the embedded server from untrusted clients and consider migrating to TomEE distributions with Tomcat connectors to prevent such vulnerabilities.

References