CVE-2026-41284

Summary

Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling

Severity

high

EPSS

0.8% (p51)

Also known as

GHSA-gx5v-xp9w-j4cg#org.apache.tomcat:tomcat, GHSA-gx5v-xp9w-j4cg#org.apache.tomcat:tomcat-catalina, GHSA-gx5v-xp9w-j4cg#org.apache.tomcat.embed:tomcat-embed-core, BIT-tomcat-2026-41284

Published

2026-05-12

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-41284
• https://github.com/apache/tomcat/commit/17dacd9aa48628da2eba37a9ab743c0b6c71685c
• https://github.com/apache/tomcat/commit/a96fffd18487a29c0a30d36f00cb2b2d91f6d42c

Related advisories

• CVE-2026-41293 — critical · Maven/org.apache.tomcat.embed:tomcat-embed-core
• CVE-2026-43512 — critical · Maven/org.apache.tomcat.embed:tomcat-embed-core
• CVE-2026-43515 — critical · Maven/org.apache.tomcat.embed:tomcat-embed-core
• CVE-2025-24813 — critical · Maven/org.apache.tomcat.embed:tomcat-embed-core
• CVE-2020-1938 — critical · Maven/org.apache.tomcat.embed:tomcat-embed-core
• CVE-2026-42498 — high · Maven/org.apache.tomcat.embed:tomcat-embed-core
• CVE-2026-43513 — high · Maven/org.apache.tomcat.embed:tomcat-embed-core
• CVE-2026-34483 — high · Maven/org.apache.tomcat.embed:tomcat-embed-core

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity