unscored
CVE-2026-97849
The embedded Derby network service ignores its configured bind address and listens on all network interfaces.
Impact
The embedded Derby network service ignores its configured bind address and listens on all network interfaces. When the service is enabled, a remote attacker with network access can connect to the database server and read or modify data. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
Affected products · Apache Software Foundation
| Product | Affected versions |
|---|---|
| Apache TomEE | from 4.0.0-beta-1 through 4.7.5 from 7.0.0-M1 before 10.0.0-M1 from 10.0.0-M1 before 10.3.0 from 11.0.0-M1 before 11.0.0-M2 Version 4.0.0-beta-1 ≤4.7.5 |