CVE-2026-41284
HIGH
Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling
Published May 12, 2026Updated May 19, 2026Source: osv
Summary
Versions Affected:
Apache Tomcat 11.0.0-M1 to 11.0.21
Apache Tomcat 10.1.0-M1 to 10.1.54
Apache Tomcat 9.0.0.M1 to 9.0.117
Older, unsupported versions may also be affected
Description:
No limit was enforced on the request body for WebDAV LOCK or PROPFIND
requests which were available to unauthenticated users.
Mitigation:
Users of the affected versions should apply one of the following
mitigations:
- Upgrade to Apache Tomcat 11.0.22 or later
- Upgrade to Apache Tomcat 10.1.55 or later
- Upgrade to Apache Tomcat 9.0.118 or later
Credit:
This issue was identified by Dariusz Gońda
Remediation
Upgrade to the fixed version using your package manager.
Maven
Update org.apache.tomcat.embed:tomcat-embed-core to 11.0.22 or later<!-- Update pom.xml dependency version to 11.0.22 for org.apache.tomcat.embed:tomcat-embed-core -->
Maven
Update org.apache.tomcat.embed:tomcat-embed-core to 9.0.118 or later<!-- Update pom.xml dependency version to 9.0.118 for org.apache.tomcat.embed:tomcat-embed-core -->
Maven
Update org.apache.tomcat.embed:tomcat-embed-core to 10.1.55 or later<!-- Update pom.xml dependency version to 10.1.55 for org.apache.tomcat.embed:tomcat-embed-core -->
Maven
Update org.apache.tomcat:tomcat-catalina to 9.0.118 or later<!-- Update pom.xml dependency version to 9.0.118 for org.apache.tomcat:tomcat-catalina -->
Maven
Update org.apache.tomcat:tomcat to 11.0.22 or later<!-- Update pom.xml dependency version to 11.0.22 for org.apache.tomcat:tomcat -->
Maven
Update org.apache.tomcat:tomcat-catalina to 11.0.22 or later<!-- Update pom.xml dependency version to 11.0.22 for org.apache.tomcat:tomcat-catalina -->
Maven
Update org.apache.tomcat:tomcat to 10.1.55 or later<!-- Update pom.xml dependency version to 10.1.55 for org.apache.tomcat:tomcat -->
Maven
Update org.apache.tomcat:tomcat to 9.0.118 or later<!-- Update pom.xml dependency version to 9.0.118 for org.apache.tomcat:tomcat -->
Maven
Update org.apache.tomcat:tomcat-catalina to 10.1.55 or later<!-- Update pom.xml dependency version to 10.1.55 for org.apache.tomcat:tomcat-catalina -->
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (9)
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| org.apache.tomcat.embed:tomcat-embed-core | maven | 11.0.0, 11.0.0-M1, 11.0.0-M10, 11.0.0-M11 (+38 more) | 11.0.22 |
| org.apache.tomcat.embed:tomcat-embed-core | maven | 7.0.0, 7.0.100, 7.0.103, 7.0.104 (+318 more) | 9.0.118 |
| org.apache.tomcat.embed:tomcat-embed-core | maven | 10.1.0, 10.1.0-M1, 10.1.0-M10, 10.1.0-M11 (+57 more) | 10.1.55 |
| org.apache.tomcat:tomcat-catalina | maven | 7.0.0, 7.0.100, 7.0.103, 7.0.104 (+318 more) | 9.0.118 |
| org.apache.tomcat:tomcat | maven | 11.0.0, 11.0.0-M1, 11.0.0-M10, 11.0.0-M11 (+38 more) | 11.0.22 |
| org.apache.tomcat:tomcat-catalina | maven | 11.0.0, 11.0.0-M1, 11.0.0-M10, 11.0.0-M11 (+38 more) | 11.0.22 |
| org.apache.tomcat:tomcat | maven | 10.1.0, 10.1.0-M1, 10.1.0-M10, 10.1.0-M11 (+57 more) | 10.1.55 |
| org.apache.tomcat:tomcat | maven | 7.0.100, 7.0.103, 7.0.104, 7.0.105 (+294 more) | 9.0.118 |
| org.apache.tomcat:tomcat-catalina | maven | 10.1.0, 10.1.0-M1, 10.1.0-M10, 10.1.0-M11 (+57 more) | 10.1.55 |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-770Allocation of Resources Without LimitsMITRE
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 7.5 score means for each attack dimension.
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-41284ADVISORY
- https://github.com/apache/tomcat/commit/17dacd9aa48628da2eba37a9ab743c0b6c71685cWEB
- https://github.com/apache/tomcat/commit/a96fffd18487a29c0a30d36f00cb2b2d91f6d42cWEB
- https://github.com/apache/tomcat/commit/b3d1c1c239142e806be0b7329d304b94a58913edWEB
- https://github.com/apache/tomcatPACKAGE
- https://lists.apache.org/thread/2nvqjr7ovjmvx2vbhb7s61ycd5msc8qcWEB
- https://tomcat.apache.org/security-10.htmlWEB
- https://tomcat.apache.org/security-11.htmlWEB
- https://tomcat.apache.org/security-9.htmlWEB
- https://www.openwall.com/lists/oss-security/2026/05/12/12WEB
Frequently Asked Questions
- What is CVE-2026-41284?
- Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling This vulnerability has been assigned a severity rating of HIGH (CVSS score: 7.5/10).
- How do I check if my project is affected by CVE-2026-41284?
- CVE-2026-41284 affects org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-catalina and org.apache.tomcat:tomcat. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-41284 and 200,000+ other known vulnerabilities.
Severity & Exploitability
CVSS Score
7.5
High exploitability or significant impact. Prioritize remediation within days.
Also Known As
GHSA-gx5v-xp9w-j4cg
BIT-tomcat-2026-41284
Related CVEs
- CVE-2026-43515CRITICAL
Apache Tomcat - Security constraints not correctly applied
- CVE-2026-43512CRITICAL
Apache Tomcat - Digest authenticator will authenticate any unknown user
- CVE-2026-41293CRITICAL
Apache Tomcat - HTTP/2 request headers not validated
- CVE-2026-42498HIGH
Apache Tomcat - WebSocket authentication header exposure
- CVE-2026-34483HIGH
Apache Tomcat has an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve
- CVE-2025-55752HIGH
Apache Tomcat Vulnerable to Relative Path Traversal
- CVE-2025-49124MEDIUM
Apache Tomcat installer for Windows has an untrusted search path vulnerability
- CVE-2025-55754LOW
Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies