AUGUST 4, 2026
Live Feed
Return to register
Case File

CVE-2011-2526

MEDIUM · CVSS 4.4 EPSS 0.70%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2011-07-14 · Last synced 2026-08-04

Field Assessment

AI analysis pending.

CVE
CVE-2011-2526
Severity
MEDIUM
CVSS
4.4
EPSS
0.70%
Apache

Original Filing — NVD Description

Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate certain request attributes, which allows local users to bypass intended file access restrictions or cause a denial of service (infinite loop or JVM crash) by leveraging an untrusted web application.