CVE-2026-41284

CVE-2026-41284: Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling

Vendor Apache Software Foundation
Product Apache Tomcat
Weakness CWE-770 · Uncontrolled resource consumption
Published May 12, 2026
Last update May 13, 2026

CVSS base score

What the vulnerability does

Description

Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117. Older, unsupported versions may also be affected. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

Key dates

Disclosure timeline

May 12, 2026 CVE published
May 13, 2026 Record updated