CVE-2026-97849
Apache TomEE: Derby network service listens on all interfaces
The embedded Derby network service ignores its configured bind address and listens on all network interfaces. When the service is enabled, a remote attacker with network access can connect to the database server and read or modify data. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
What each source reports
CVE List No score
Apache TomEE: Derby network service listens on all interfaces
The embedded Derby network service ignores its configured bind address and listens on all network interfaces. When the service is enabled, a remote attacker with network access can connect to the database server and read or modify data. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
- Record
CVE-2026-97849- Weakness
- CWE-1327
- Updated
- 2026-11-10
EUVDEUVD-2026-121161 No score
The embedded Derby network service ignores its configured bind address and listens on all network interfaces. When the service is enabled, a remote attacker with network access can connect to the database server and read or modify data. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
- Record
EUVD-2026-121161- Updated
- 2026-11-10
GitHub AdvisoriesGHSA-pr33-cxfx-hmvr No score
The embedded Derby network service ignores its configured bind address and listens on all network...
The embedded Derby network service ignores its configured bind address and listens on all network interfaces. When the service is enabled, a remote attacker with network access can connect to the database server and read or modify data. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
- Record
GHSA-pr33-cxfx-hmvr- Weakness
- CWE-1327
- Updated
- 2026-11-10
NVD No score
The embedded Derby network service ignores its configured bind address and listens on all network interfaces. When the service is enabled, a remote attacker with network access can connect to the database server and read or modify data. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue.
- Record
CVE-2026-97849- Weakness
- CWE-1327
- Updated
- 2026-11-10
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| published | EUVD | |
| published | EUVD | |
| aliases, references | GitHub Advisories, NVD | |
| cwes, references, title | CVE List | |
| first indexed | EUVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-97849 is a vulnerability with no CVSS score yet in Apache Software Foundation Tomee, published November 10, 2026. No source lists public exploit code. No source names a fixed version.