CVE-2026-55276
published 2026-06-29CVE-2026-55276: Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when…
PriorityP263critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
0.56%
44.7th percentile
Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.
Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tomcat | < 9.0.119 | 9.0.119 |
| apache | tomcat | — | — |
| apache | tomcat | >= 10.1.0 < 10.1.56 | 10.1.56 |
| apache | tomcat | >= 11.0.0 < 11.0.23 | 11.0.23 |
| apache_software_foundation | apache_tomcat | 10.1.0-M1 – 10.1.55 | — |
| apache_software_foundation | apache_tomcat | 11.0.0-M1 – 11.0.22 | — |
| apache_software_foundation | apache_tomcat | 8.5.0 – 8.5.100 | — |
| apache_software_foundation | apache_tomcat | 9.0.0.M1 – 9.0.118 | — |
| debian | tomcat10 | — | — |
| debian | tomcat11 | — | — |
| debian | tomcat9 | — | — |
| pki-deps_10.6 | pki-servlet-engine | — | — |
| ubuntu | tomcat8 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →CVE-2026-55276 is a logging-only flaw in Apache Tomcat where special roles and empty authorization constraints are omitted from the effective web.xml debug log output. Detection should focus on identifying vulnerable Tomcat versions in the environment (11.0.0-M1 through 11.0.22, 10.1.0-M1 through 10.1.55, 9.0.0.M1 through 9.0.118, 8.5.0 through 8.5.100) and auditing whether administrators are relying solely on the effective web.xml debug log to verify security constraints. ↗
- →When reviewing Tomcat debug logs for effective web.xml output, be aware that on affected versions the logged output may be incomplete — missing special roles and empty authorization constraints — which could cause administrators to misinterpret the actual security posture. ↗
- ·This is a logging-only issue with no runtime security impact. The flaw only affects the accuracy of debug log output for administrators reviewing the effective web.xml configuration — it does not affect actual runtime enforcement of authorization constraints. ↗
- ·Administrators should not rely solely on the effective web.xml debug log output to verify security constraint configuration on affected Tomcat versions. ↗
- ·Affected version ranges: Apache Tomcat 11.0.0-M1 through 11.0.22, 10.1.0-M1 through 10.1.55, 9.0.0.M1 through 9.0.118, and 8.5.0 through 8.5.100. Other end-of-support versions may also be affected. Fixed in 11.0.23, 10.1.56, and 9.0.119. ↗
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
vendor_ubuntu9.1CRITICAL
vendor_redhat2.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Apache Tomcat up to 11.0.22 web.xml control flow (EUVD-2026-40230)
vuldb·2026-06-30
CVE-2026-55276 [CRITICAL] Apache Tomcat up to 11.0.22 web.xml control flow (EUVD-2026-40230)
A vulnerability identified as critical has been detected in Apache Tomcat up to 7.x/8.5.100/9.0.118/10.1.55/11.0.22. Affected by this issue is some unknown functionality of the file web.xml. The manipulation leads to incorrect control flow.
This vulnerability is referenced as CVE-2026-55276. Remote exploitation of the attack is possible. No exploit is available.
You should upgrade the affected component.
GHSA
Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged.
ghsa_unreviewed·2026-06-29
CVE-2026-55276 [CRITICAL] CWE-670 Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged.
Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.
Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue.
Ubuntu
Tomcat vulnerabilities
vendor_ubuntu·2026-07-15·CVSS 9.1
CVE-2026-50229 [CRITICAL] Tomcat vulnerabilities
Title: Tomcat vulnerabilities
Summary: Several security issues were fixed in Tomcat.
It was discovered that Tomcat incorrectly handled authorization when
multiple method constraints defined the same HTTP method. A remote
attacker could possibly use this issue to bypass authorization
restrictions. (CVE-2026-43515)
It was discovered that the Tomcat number guess example application did
not properly sanitize user-supplied input. An attacker could possibly
use this issue to inject malicious scripts, resulting in cross-site
scripting. (CVE-2026-50229)
It was discovered that Tomcat incorrectly evaluated rewrite valve
conditions in certain configurations. An attacker could possibly use
this issue to bypass rewrite rules, resulting in unauthorized access.
(CVE-2026-53404)
It was discovered tha
Red Hat
tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow
vendor_redhat·2026-06-29·CVSS 2.3
CVE-2026-55276 [LOW] CWE-778 tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow
tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow
A flaw was found in Apache Tomcat. Due to an always-incorrect control flow implementation, special roles and empty authorization constraints were not accurately included when the effective web.xml configuration was logged. This could lead to a security oversight where administrators might misinterpret the actual authorization constraints, potentially impacting the security posture of the application.
Statement: A flaw was found in Apache Tomcat. When the effective web.xml logging feature is enabled for debugging, special roles and empty authorization constraints may be omitted from the logged output. This is a logging-only issue with no runtime security impact — it only affects the accuracy of debug log output
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-55276 tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow
bugzilla·2026-06-29
CVE-2026-55276 [LOW] CVE-2026-55276 tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow
CVE-2026-55276 tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow
Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.
Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue.
Bugzilla
CVE-2026-55276 tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow [fedora-all]
bugzilla·2026-06-29
CVE-2026-55276 CVE-2026-55276 tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow [fedora-all]
CVE-2026-55276 tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.
Users are recommended to upgrade to version 1
2026-06-29
Published