CVE-2026-41284
- Source
- https://cve.org/CVERecord?id=CVE-2026-41284
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41284.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-41284
- Aliases
- Downstream
CGA (43)
- CGA-2749-4j69-f25j
- CGA-28gc-qhq8-723j
- CGA-2q7c-ccw7-fcmf
- CGA-4r2j-rfmp-j5q2
- CGA-5jp9-9rf9-h89p
- CGA-5mpr-3j6m-8gp6
- CGA-6472-4rqx-6f3c
- CGA-68w8-3wjw-vc6f
- CGA-77x5-v69g-45j6
- CGA-798v-c6m4-h2gc
- CGA-7xp6-jrv6-pw69
- CGA-8p23-wvpf-5696
- CGA-9785-5gv3-fwxh
- CGA-9rmj-4948-6h37
- CGA-9vrm-5wqf-pc6v
- CGA-9vvh-7q69-4fgv
- CGA-cjqr-c66g-x23h
- CGA-cq6m-2xfp-x8vw
- CGA-fjjw-377p-6h8f
- CGA-g422-4f2h-9p7r
- CGA-g84c-j6pm-crcw
- CGA-gc8v-ppj4-wwq8
- CGA-gv2w-678w-rgcc
- CGA-hp3j-6369-852x
- CGA-hpc8-c386-xj5g
- CGA-jmhq-w9m7-73fq
- CGA-m52p-jj2m-683f
- CGA-m5fc-x2q6-mwq5
- CGA-mxww-vrqf-vr7m
- CGA-p463-gf7r-cj97
- CGA-p7xw-c67c-jmhg
- CGA-pp3h-2396-rrrm
- CGA-pp46-2ch4-6cpv
- CGA-pxh8-v8p9-x7x2
- CGA-q4h2-jwwj-h6cj
- CGA-qf5h-cqcg-xvc8
- CGA-qqf8-5v26-c78r
- CGA-rg69-3q92-mf65
- CGA-rprm-27hp-pgr7
- CGA-vhmr-gh8p-xxm7
- CGA-vrr7-f9wh-j3mr
- CGA-w3jr-48q7-cw6m
- CGA-wcrv-7m4h-95vm
CLEANSTART (7)
CLSA (12)
DEBIAN (1)
MGASA (1)
MINI (1)
OESA (1)
openSUSE (6)
RHSA (12)
ROOT (1)
SUSE (7)
- Related
- Published
- 2026-05-12T15:14:45Z
- Modified
- 2026-10-29T11:42:22Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling
- Details
-
Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117. Older, unsupported versions may also be affected.
Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.
- Database specific
{ "cna_assigner": "apache", "cwe_ids": [ "CWE-770" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41284.json", "unresolved_ranges": [ { "extracted_events": [ { "range": [ { "introduced": "11.0.0-M1" }, { "last_affected": "11.0.21" }, { "introduced": "10.1.0-M1" }, { "last_affected": "10.1.54" }, { "introduced": "9.0.0.M1" }, { "last_affected": "9.0.117" }, { "introduced": "10.0.0-M1" }, { "last_affected": "10.0.27" }, { "introduced": "8.5.0" }, { "last_affected": "8.5.100" }, { "introduced": "4.0" }, { "last_affected": "7.0.109" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" } ] } ] }- References
Affected packages
Git / github.com/apache/tomcat
Affected ranges
- Type
- GIT
- Repo
- https://github.com/apache/tomcat
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedLast AffectedIntroducedLast AffectedIntroducedFixedIntroducedLast AffectedIntroducedFixedIntroducedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "range": [ { "introduced": "4.0.0" }, { "last_affected": "7.0.109" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "range": [ { "introduced": "8.5.0" }, { "last_affected": "8.5.100" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "range": [ { "introduced": "9.0.0" }, { "fixed": "9.0.118" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "range": [ { "introduced": "10.0.0" }, { "last_affected": "10.0.27" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "range": [ { "introduced": "10.1.0" }, { "fixed": "10.1.55" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "range": [ { "introduced": "11.0.0" }, { "fixed": "11.0.22" } ], "source": "CPE_RANGE" } ] }