Skip to main content

Apache Tomcat EUVDEUVD-2026-40230

| CVE-2026-55276 CRITICAL
Always-Incorrect Control Flow Implementation (CWE-670)
2026-06-29 apache GHSA-mqg3-r7h5-24x4
Information Disclosure Tomcat Apache Apache Tomcat Red Hat Suse
9.1
CVSS 3.1 · Vendor: apache
Share

Severity by source

Vendor (apache) PRIMARY
9.1 LOW
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
vuln.today AI
2.3 LOW

Affects only the accuracy of locally logged configuration available to a privileged operator (PR:H, AV:L); at most minor confidentiality of audit data (C:L), with no integrity or availability impact.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
3.3 LOW
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Red Hat
2.3 LOW
qualitative

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

6
Analysis Updated
Jun 30, 2026 - 15:29 vuln.today
v3 (cvss_changed)
Analysis Updated
Jun 30, 2026 - 15:28 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jun 30, 2026 - 15:22 vuln.today
cvss_changed
Severity Changed
Jun 30, 2026 - 15:22 NVD
LOW CRITICAL
CVSS changed
Jun 30, 2026 - 15:22 NVD
9.1 (LOW) 9.1 (CRITICAL)
Analysis Generated
Jun 29, 2026 - 21:18 vuln.today

DescriptionCVE.org

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue.

Articles & Coverage 1

News Critical Security Constraint Bypass in Apache Tomcat - CVE-2026-55276 Jun 30, 2026

AnalysisAI

Incomplete security-constraint logging in Apache Tomcat (8.5.0-8.5.100, 9.0.0.M1-9.0.118, 10.1.0-M1-10.1.55, 11.0.0-M1-11.0.22) omits special roles and empty authorization constraints when the effective web.xml is written to the log, giving administrators an inaccurate view of the deployed access-control configuration. There is no public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and CISA SSVC marks exploitation status as none, despite the inflated 9.1 CVSS published by Apache. The practical effect is misleading audit/diagnostic output rather than direct attacker compromise.

Technical ContextAI

Apache Tomcat can log the 'effective web.xml' - the merged deployment descriptor combining the application's WEB-INF/web.xml, fragments, annotations, and container defaults - to help operators verify the security model actually applied to a web application. The defect is classified as CWE-670 (Always-Incorrect Control Flow Implementation): the code path that serializes security constraints into this logged output fails to include security-constraint elements that reference special roles (such as the wildcard '*' / '**' role names) and constraints with an empty <auth-constraint/> (which denies all access). As a result the logged descriptor does not faithfully represent constraints that Tomcat still enforces at runtime. The CPE cpe:2.3:a:apache_software_foundation:apache_tomcat covers the affected branches; the underlying enforcement of authorization is unaffected - only its reflection in the logged effective web.xml is wrong.

RemediationAI

Vendor-released patch: upgrade to Apache Tomcat 11.0.23, 10.1.56, or 9.0.119, which fix the effective web.xml logging behavior, as documented in the Apache advisory (https://lists.apache.org/thread/jy09xjlzn6r2qwvqoph8vcmf959yq68v). Because the defect only affects the accuracy of logged configuration and not runtime enforcement, an interim workaround on unpatched instances is to stop relying on the logged effective web.xml as the source of truth for security-constraint review - instead validate special roles and empty <auth-constraint/> entries directly against the application's deployed web.xml, fragments, and annotations; the trade-off is additional manual verification effort. No network feature needs to be disabled, so no service-impacting mitigation is required.

More in Tomcat

View all
CVE-2017-12617 HIGH POC
8.1 Oct 04

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
CVE-2023-47246 CRITICAL POC
9.8 Nov 10

In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a f
CVE-2016-8735 CRITICAL POC
9.8 Apr 06

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
CVE-2017-12615 HIGH POC
8.1 Sep 19

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. Rated high severity (CVSS 8.1), this

CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2014-0050 HIGH POC
7.5 Apr 01

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products,
CVE-2017-12616 HIGH
7.5 Sep 19

When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or

CVE-2014-0227 MEDIUM
6.4 Feb 16

java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and
CVE-2026-34486 HIGH POC
7.5 Apr 09

Missing encryption of cluster replication traffic in Apache Tomcat 11.0.20, 10.1.53, and 9.0.116 exposes sensitive sessi
CVE-2013-5528 MEDIUM POC
4.0 Oct 11

Directory traversal vulnerability in the Tomcat administrative web interface in Cisco Unified Communications Manager all
CVE-2016-6808 CRITICAL POC
9.8 Apr 12

Buffer overflow in Apache Tomcat Connectors (mod_jk) before 1.2.42. Rated critical severity (CVSS 9.8), this vulnerabili
CVE-2016-1240 HIGH POC
7.8 Oct 03

The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debia

Same weakness CWE-670 – Always-Incorrect Control Flow Implementation

View all
CVE-2020-17466 CRITICAL POC
9.8
CVE-2025-29312 CRITICAL POC
9.1
CVE-2018-16766 HIGH POC
8.8
CVE-2026-26267 HIGH POC
7.5
CVE-2024-53270 HIGH POC
7.5
CVE-2024-53269 HIGH POC
7.5
CVE-2024-37153 HIGH POC
7.5
CVE-2023-41376 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Low
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Web and Scripting 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server for SAP applications 16.0 Fixed
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 Fixed
openSUSE Leap 16.0 Fixed
openSUSE Tumbleweed Fixed

Share

EUVD-2026-40230 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy