CVE record · 1 source
CVE-2026-97888
The embedded HTTP server does not clear the security identity established during a request before its worker thread handles the next request.
- Vendor
- Apache Software Foundation
- Product
- Apache TomEE
- Weakness
- CWE-488
- Exposure class
- Web platform
Coverage
1Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.
-
The embedded HTTP server does not clear the security identity established during a request before its worker thread handles the next request.
The embedded HTTP server does not clear the security identity established during a request before its worker thread handles the next request. A remote unauthenticated attacker can have their request processed with the identity of…