CVE-2026-41284

Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117. Older, unsupported versions may also be affected. Users are recommended to upgrade to version [FIXED_VERSION], which fixes the issue.

Scoring

Severity

HIGH

CVSS base score

7.5

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS probability

0.84%

CWE

CWE-770

Published

2026-05-12

Last modified

2026-05-13

Affected products

• Apache Software Foundation Apache Tomcat
• Apache Software Foundation Apache Tomcat
• Apache Software Foundation Apache Tomcat
• Apache Software Foundation Apache Tomcat
• Apache Software Foundation Apache Tomcat
• Apache Software Foundation Apache Tomcat

Weakness type

• CWE-770

Related vulnerabilities

• CVE-2026-87011 — Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout
• CVE-2023-54394 — PocketMine-MP before 4.18.0-ALPHA2 Bandwidth Amplification via InventoryTransactionPacket
• CVE-2026-53937 — MCP Kotlin SDK's unbounded line buffer in StdioServerTransport/StdioClientTransport leads to memory exhaustion (DoS)
• CVE-2026-86075 — n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint
• CVE-2026-57099 — ASP.NET Core Denial of Service Vulnerability
• CVE-2026-69374 — Windows SMB Server Denial of Service Vulnerability
• CVE-2026-72978 — Active Directory Federation Services (AD FS) Denial of Service Vulnerability
• CVE-2026-82075 — Uncontrolled Resource Consumption in MongoDB Sharded Cluster Router Allows Unauthenticated Denial of Service

Markdown version · Browse all CVEs