CVE-2026-41284

Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling

Description

Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117. Older, unsupported versions may also be affected. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

Scores

Weaknesses (CWE)

• CWE-770

Advisories

• GHSA-gx5v-xp9w-j4cg — Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling

European references

• ENISA EUVD · EUVD-2026-29513
• GCVE · GCVE-0-2026-41284

CERT-FR advisories

• CERTFR-2026-AVI-1165 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
• CERTFR-2026-AVI-0986 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
• CERTFR-2026-AVI-0773 — Multiples vulnérabilités dans les produits Atlassian · cert.ssi.gouv.fr
• CERTFR-2026-AVI-0577 — Multiples vulnérabilités dans Apache Tomcat · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

• cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* ≥ 4.0.0 ≤ 7.0.109
• cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* ≥ 8.5.0 ≤ 8.5.100
• cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* ≥ 9.0.0 < 9.0.118
• cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* ≥ 10.0.0 ≤ 10.0.27
• cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* ≥ 10.1.0 < 10.1.55
• cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* ≥ 11.0.0 < 11.0.22

Affected products

References

• https://lists.apache.org/thread/2nvqjr7ovjmvx2vbhb7s61ycd5msc8qc
• http://www.openwall.com/lists/oss-security/2026/05/12/12

Sources