Apache TomEE vulnerabilities and CVEs
Known vulnerabilities affecting Apache TomEE, with exploit availability attached to each one, so you can tell a flaw someone has written code for from one nobody has.
38 vulnerabilities tracked.
- — Apache TomEE running on JDK 21 or later skips EJB method authorization checks, allowing callers to invoke EJB methods without the…
- — The embedded OpenEJB HTTP server does not limit the size of incoming request bodies or of multipart requests, and does not remove the…
- — The remote EJB client does not verify that the hostname of the server it connects to matches the server's TLS certificate.
- — The embedded Derby network service ignores its configured bind address and listens on all network interfaces.
- — The EJBd remote protocol returns datasource connection details, including database credentials, to remote clients that look up a datasource.
- — When Hessian remoting endpoints are served by the embedded HTTP server, configured authentication and transport security requirements are…
- — When an EJB is exposed over the optional Hessian protocol inside an existing web application, some configured authentication and transport…
- — When Hessian remoting is configured with BASIC authentication, the authentication check is not applied to Hessian endpoints of applications…
- — The security constraint generated for EJB JAX-WS endpoints with configured authentication protects only some HTTP methods.
- — The internal system EJBs used for remote deployment and configuration did not enforce their administrative role check when the server ran…
- — Stateful session bean identifiers are not generated from a cryptographically secure random source.
- — The stateful session bean passivation mechanism derives the on-disk file name from a client-supplied identifier without validating it.
- — The bundled JAAS login modules leak whether a username exists and compare credentials in a non-constant-time manner.
- — Authentication configured for an EJB JAX-WS endpoint in the TomEE deployment descriptor is not enforced when the endpoint is published…
- — The Jakarta Security LDAP identity store does not neutralize special characters in the caller name before using it in directory queries.
- — The embedded OpenEJB HTTP server dispatches some requests to REST endpoints configured for HTTP Basic authentication without verifying…
- — The embedded OpenEJB HTTP server does not restrict static resource paths to the configured resource directories.
- — The embedded HTTP server does not clear the security identity established during a request before its worker thread handles the next…
- — The embedded HTTP server does not invalidate the previous session identifier when an application changes the session id, e.g.
- — The optional SSH administration service grants full access to the administration shell to every user that authenticates against its…
- — The JDBC based JAAS login module accepts a login without a password for accounts whose stored password is NULL.
- — When a non-default stateful session bean passivation strategy is configured, passivated bean state is written to predictably named files in…
- — When MicroProfile JWT authentication is used for servlets that declare a run-as identity, the security state established for a request is…
- — A negative MicroProfile JWT clock skew setting is not rejected and disables validation of the token expiration and other time-based claims.
- — When MicroProfile JWT role-based access control is used, the access constraints of JAX-RS resources are not always enforced as declared:…
- — After a successful WS-Security UsernameToken authentication, the caller identity stays associated with the worker thread once the request…
- — The embedded OpenEJB HTTP server does not isolate HTTP sessions between web applications.
- — When resolving security roles of a realm-authenticated caller, the caller's user name is also treated as a role name in addition to the…
- — The Jakarta Security identity store backed by the Tomcat user database compares the supplied password with the stored value as plain text…
- — The development-time LiveReload support listens on all network interfaces without authentication and accepts websocket connections from any…
- — The embedded OpenEJB HTTP server reports every request as authenticated when an application requests authentication programmatically.
- — The admin service of the standalone OpenEJB server accepts stop requests without any authentication.
- — When JAX-WS or JAX-RS endpoints are published by the embedded OpenEJB HTTP server rather than Tomcat, some configured authentication…
- — With the default configuration and no users defined in the default user database, TomEE silently adds an administrative user with a…
- — The optional request routing feature forwards requests to their configured destination without applying the security constraints of that…
- — The embedded server generates HTTP session identifiers with a non-cryptographic random number generator by default.
- — The Jakarta Security OpenID Connect authentication mechanism generates the state and nonce values with a non-cryptographic random number…
- — The Jakarta Security LDAP identity store accepts an empty password as valid if the directory server allows unauthenticated binds, which…
What this covers
This feed accumulates forward from the day it started storing records, and a name search that finds nothing here is also looked up against the registers directly — so an older advisory resolves even when it predates the corpus. It is still a reading view, not a substitute for the vendor's own advisory, and absence from this page is not a statement that Apache TomEE is free of vulnerabilities.
Query this from an agent over MCP · Check a lockfile by version
Other products tracked here
Linux Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 macOS API Connect Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Chrome Red Hat Enterprise Linux 9.6 Extended Update Support Zephyr Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 10.0 Extended Update Support Red Hat Enterprise Linux 8.8 Telecommunications Update Service Red Hat Enterprise Linux 7 Extended Lifecycle Support Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On iOS and iPadOS Red Hat Hardened Images Windows Server 2022 Windows 11 Version 24H2 Windows 11 version 26H1 Windows 11 Version 25H2 Windows Server 2025