Junglewise Threat Intelligence

CVE-2026-41284: Apache Tomcat resource exhaustion in WebDAV LOCK and PROPFIND handling

CVE-2026-41284 · Severity: high · CVSS 7.5 · Published 2026-05-12

Technologies: Apache Tomcat. Vendors: Apache.

Executive brief

Apache Tomcat is a widely used web server and application container for Java-based software. A vulnerability in its WebDAV component allows unauthenticated remote users to send excessively large requests, which can exhaust server resources. This could lead to a denial-of-service (DoS) condition, making the web server or hosted applications unavailable to legitimate users.

Technical details

A resource exhaustion vulnerability (CWE-770) exists in Apache Tomcat's WebDAV implementation. The server fails to enforce a limit on the request body size for WebDAV LOCK and PROPFIND requests. Because these methods are often accessible to unauthenticated users, a remote attacker can send specially crafted, large XML request bodies to consume excessive memory or CPU, leading to a denial of service. The fix introduces a configurable 'maxRequestBodySize' parameter for the WebDAV servlet, defaulting to 4096 bytes. Patches are available in versions 11.0.22, 10.1.55, and 9.0.118.

Affected products

  • Apache Tomcat 11.0.0-M1 to 11.0.21, 10.1.0-M1 to 10.1.54, 9.0.0.M1 to 9.0.117, 10.0.0-M1 to 10.0.27, 8.5.0 to 8.5.100, 4.0 to 7.0.109

Timeline

  • 2026-05-12: disclosed
  • 2026-05-12: advisory

References