CVE-2026-55956

MediumCVSS 6.5/10Last modified Oct 25, 2026

Description

Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-285

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Tomcat	>= 11.0.0-M1, <= 11.0.22; >= 10.1.0-M1, <= 10.1.55; >= 9.0.0.M1, <= 9.0.118; >= 8.5.0, <= 8.5.100; >= 7.0.0, <= 7.0.109

References

https://lists.apache.org/thread/dcjdcnnnww9hhdm016hr0l7hpw1bzjfpVendor Advisory, Mailing List
http://www.openwall.com/lists/oss-security/2026/06/29/25Third Party Advisory

Timeline

Published: Jun 29, 2026
Last modified: Oct 25, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-559577.3Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI CVE-2026-559587.5Out-of-bounds write in the Renesas TSIP TLS 1.3 transcript buffer. In tsip_StoreMessage() the capacity check guarding the fixed message bag CVE-2026-55966.3A vulnerability was detected in griptape-ai griptape 0.19.4. Affected by this issue is some unknown functionality of the file griptape/tools CVE-2026-559607.5Un-negotiated Raw Public Key (RFC 7250) accepted in place of an X.509 certificate, bypassing chain validation. A raw public key has no chain CVE-2026-559617.5wolfSSL_PKCS7_verify() returning success for a degenerate (certs-only) PKCS#7 object that contains no signer. Such an object has empty signe CVE-2026-559626.5TLS 1.3 post-handshake authentication (PHA) issue where a server could accept a client's Finished message without the client having sent a C CVE-2026-559645.3Chain intermediate CA:TRUE without keyCertSign accepted as a signing CA. Intermediate CA certificates are required to have the keyCertSign k CVE-2026-559677.5AES-GCM encryption/decryption with extremely large cumulative single message sizes (>64 GiB) were not properly rejected by the streaming API CVE-2026-559687.5Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings. T CVE-2026-559697.5Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi and Haxe bindings. This issue affects Apache CVE-2026-55976.3A flaw has been found in griptape-ai griptape 0.19.4. This affects an unknown part of the file griptape\tools\computer\tool.py of the compon CVE-2026-559706.5Buffer Over-read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to up