CVE-2026-97870

When Hessian remoting endpoints are served by the embedded HTTP server, configured authentication and transport security requirements are silently ignored. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials or over an unencrypted connection. Only deployments...

CVE-2026-97872

When an EJB is exposed over the optional Hessian protocol inside an existing web application, some configured authentication and transport security settings are silently not enforced. A remote unauthenticated attacker can invoke the exposed EJB methods. Only deployments using the Hessian module...

CVE-2026-97874

When Hessian remoting is configured with BASIC authentication, the authentication check is not applied to Hessian endpoints of applications deployed under a non-root context path. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials. Users are recommended to...

EUVD-2026-121158

When Hessian remoting endpoints are served by the embedded HTTP server, configured authentication and transport security requirements are silently ignored. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials or over an unencrypted connection. Only deployments...

CVE-2026-97870 Apache TomEE: Missing authentication for Hessian endpoints in embedded HTTP server

When Hessian remoting endpoints are served by the embedded HTTP server, configured authentication and transport security requirements are silently ignored. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials or over an unencrypted connection. Only deployments...

CVE-2026-97870

Apache TomEE is vulnerable to a missing authentication flaw in its embedded HTTP server when serving Hessian remoting endpoints. The vulnerability occurs because configured authentication and transport security requirements are silently ignored, allowing a remote unauthenticated attacker to invok...

CVE-2026-97872 Apache TomEE: Authentication bypass of Hessian EJB endpoints due to ignored security settings

When an EJB is exposed over the optional Hessian protocol inside an existing web application, some configured authentication and transport security settings are silently not enforced. A remote unauthenticated attacker can invoke the exposed EJB methods. Only deployments using the Hessian module...

EUVD-2026-121157

When an EJB is exposed over the optional Hessian protocol inside an existing web application, some configured authentication and transport security settings are silently not enforced. A remote unauthenticated attacker can invoke the exposed EJB methods. Only deployments using the Hessian module...

CVE-2026-97872

In Apache TomEE , an authentication bypass exists when an EJB is exposed over the optional Hessian protocol . The vulnerability is caused by certain configured authentication and transport security settings being silently ignored, allowing a remote unauthenticated attacker to invoke exposed EJB m...

CVE-2026-97874 Apache TomEE: Authentication bypass for Hessian endpoints in non-root web applications

When Hessian remoting is configured with BASIC authentication, the authentication check is not applied to Hessian endpoints of applications deployed under a non-root context path. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials. Users are recommended to...

EUVD-2026-121156

When Hessian remoting is configured with BASIC authentication, the authentication check is not applied to Hessian endpoints of applications deployed under a non-root context path. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials. Users are recommended to...

CVE-2026-97874

Apache TomEE is vulnerable to an authentication bypass when Hessian remoting is configured with BASIC authentication . The issue occurs because authentication checks are not applied to Hessian endpoints for applications deployed under a non-root context path . This allows a remote unauthenticated...

PT-2026-141787

When Hessian remoting endpoints are served by the embedded HTTP server, configured authentication and transport security requirements are silently ignored. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials or over an unencrypted connection. Only deployments...

PT-2026-141788

When an EJB is exposed over the optional Hessian protocol inside an existing web application, some configured authentication and transport security settings are silently not enforced. A remote unauthenticated attacker can invoke the exposed EJB methods. Only deployments using the Hessian module...

CVE-2026-97870: Apache Software Foundation Apache TomEE: When Hessian remoting endpoints are served by the embedded HTTP server, configured authentication and transport…

When Hessian remoting endpoints are served by the embedded HTTP server, configured authentication and transport security requirements are silently ignored. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials or over an unencrypted connection. Only deployments...

CVE-2026-97872: Apache Software Foundation Apache TomEE: When an EJB is exposed over the optional Hessian protocol inside an existing web application, some configured…

When an EJB is exposed over the optional Hessian protocol inside an existing web application, some configured authentication and transport security settings are silently not enforced. A remote unauthenticated attacker can invoke the exposed EJB methods. Only deployments using the Hessian module...

CVE-2026-97874: Apache Software Foundation Apache TomEE: When Hessian remoting is configured with BASIC authentication, the authentication check is not applied to Hessian…

When Hessian remoting is configured with BASIC authentication, the authentication check is not applied to Hessian endpoints of applications deployed under a non-root context path. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials. Users are recommended to...

PT-2026-141789

When Hessian remoting is configured with BASIC authentication, the authentication check is not applied to Hessian endpoints of applications deployed under a non-root context path. A remote unauthenticated attacker can invoke the exposed EJB methods without credentials. Users are recommended to...

dubbo-CVE-2023-23638

CVE-2023-23638 For educational purposes only ZooKeeper required Tested on Java 8. Other versions have not been tested and are not guaranteed to work. To reproduce, add the VM parameter to DemoComsumer: -Ddubbo.hessian.allowNonSerializable=true. For details, see...

dubbo-rce

CVE-2023-23638 For learning and research purposes only. ZooKeeper is required. The test environment is Java 8. Other versions have not been tested and usability is not guaranteed. During reproduction, you need to add the VM parameter to DemoComsumer: -Ddubbo.hessian.allowNonSerializable=true. For...