Improper Network Binding in Derby Network Service by Apache
CVE-2026-97849

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Tomee
Vendor
CVE Published:
10 November 2026

What is CVE-2026-97849?

The Derby network service by Apache is prone to a configuration flaw that leads it to ignore its specified bind address, resulting in it listening on all network interfaces. This oversight poses a risk as remote attackers with network access can potentially establish connections to the database server, allowing them to read or modify sensitive data. It is crucial for users to upgrade to versions 10.3.0 or 11.0.0-M2 to mitigate this vulnerability.

Affected Version(s)

Apache TomEE 4.0.0-beta-1 <= 4.7.5

Apache TomEE 7.0.0-M1 < 10.0.0-M1

Apache TomEE 10.0.0-M1 < 10.3.0

References

https://lists.apache.org/thread/20fl5wnn3slxs0tq0ktmrc9xv...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

The Apache Software Foundation
Claude Security
Markus Jung
.