Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 Apache Tomcat 9.0.0.M1 to 9.0.117 Older, unsupported versions may also be affected
Description: No limit was enforced on the request body for WebDAV LOCK or PROPFIND requests which were available to unauthenticated users.
Mitigation: Users of the affected versions should apply one of the following mitigations:
Credit: This issue was identified by Dariusz Gońda
{
"cwe_ids": [
"CWE-770"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-18T20:26:58Z",
"nvd_published_at": "2026-05-12T16:16:15Z",
"severity": "HIGH"
}