Skip to content

CVE record · 1 source

CVE-2026-111259

The embedded server generates HTTP session identifiers with a non-cryptographic random number generator by default.

Vendor: Apache Software Foundation
Product: Apache TomEE
Weakness: CWE-338
Exposure class: Web platform

Coverage

1

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

25

CVE NVD 2h ago

The embedded server generates HTTP session identifiers with a non-cryptographic random number generator by default.

The embedded server generates HTTP session identifiers with a non-cryptographic random number generator by default. A remote attacker who observes a session identifier can predict the identifiers issued to other users and hijack…

Fix available CVE-2026-111259 Apache Software Foundation