CVE-2026-55276

CriticalCVSS 9.1/10Last modified Oct 25, 2026

Description

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-670

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Tomcat	>= 11.0.0-M1, <= 11.0.22; >= 10.1.0-M1, <= 10.1.55; >= 9.0.0.M1, <= 9.0.118; >= 8.5.0, <= 8.5.100

References

https://lists.apache.org/thread/jy09xjlzn6r2qwvqoph8vcmf959yq68vVendor Advisory, Mailing List
http://www.openwall.com/lists/oss-security/2026/06/29/23Third Party Advisory

Timeline

Published: Jun 29, 2026
Last modified: Oct 25, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-552778.0In checkUiccListenConfigNeeded of RoutingManager.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead CVE-2026-55286.3A security vulnerability has been detected in MoussaabBadla code-screenshot-mcp up to 0.1.0. This affects an unknown part of the component H CVE-2026-552808.8In multiple locations, there is a possible out-of-bounds write due to uninitialized data. This could lead to remote escalation of privilege CVE-2026-552838.4In multiple locations, there is a possible memory safety issue due to a use-after-free. This could lead to remote escalation of privilege wi CVE-2026-552857.8In openLogicalChannel of multiple files, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local esc CVE-2026-552867.8In stpropnci_process of stpropnci.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local esc CVE-2026-552878.4In onCreate of GrantCredentialsPermissionActivity.java, there is a possible way to trick the user into granting account credentials due to m CVE-2026-552888.4In validEfCfis of SIMRecords.java, there is a possible way to cause a denial of service due to an uncaught exception. This could lead to loc CVE-2026-552898.4In multiple functions in multiple locations, there is a possible execution of sensitive USSD codes due to a confused deputy. This could lead CVE-2026-55294.3A vulnerability was detected in Dromara lamp-cloud up to 5.8.1. This vulnerability affects the function pageUser of the file /defUser/pageUs CVE-2026-552903.3In setTo of ResourceTypes.cpp, there is a possible out-of-bounds heap read due to a missing bounds check. This could lead to local informati CVE-2026-552925.3In rw_ci_data_cback of rw_ci.cc, there is a possible memory safety issue due to integer underflow. This could lead to remote information dis