> CVE-2026-55956

« BACK_TO_HOME
PUBLISHED
2026-06-29 21:16
MODIFIED
2026-06-29 21:16
EPSS (Prob. Exploit)
0.70%
Top 47.0%
DATA SOURCES:
NVD 🔗 2026-06-29 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-11-01 GITHUB 🔗 2026-11-05 OSV 🔗 2026-11-02

> DESCRIPTION

Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> WEAKNESSES

CWE-285

> CWE DETAILED DESCRIPTIONS

CWE-285: Improper Authorization - The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

> RED HAT SECURITY ADVISORIES

Red Hat Security Advisory: Red Hat JBoss Web Server 7.0.0 security release
Red Hat JBoss Web Server 7.0 is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a s...
Red Hat Security Advisory: Red Hat JBoss Web Server 7.0.0 security release
Red Hat JBoss Web Server 7.0.0 zip release is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Linux Enterprise 10, and Windows Server. Red Hat Product Security has r...
Red Hat Security Advisory: Red Hat JBoss Web Server 6.2.4 release and security update
Red Hat JBoss Web Server 6.2.4 is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, and Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a...
Red Hat Security Advisory: Red Hat JBoss Web Server 6.2.4 release and security update
Red Hat JBoss Web Server 6.2.4 zip release is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Windows Server. Red Hat Product Security has r...

> GITHUB SECURITY ADVISORY

GHSA-5v3h-fjv2-54fg MODERATE

Apache Tomcat has an Improper Authorization vulnerability

AFFECTED PACKAGES:
MAVEN / org.apache.tomcat:tomcat-catalina
<= 7.0.109
MAVEN / org.apache.tomcat:tomcat-catalina
>= 8.5.0, <= 8.5.100
MAVEN / org.apache.tomcat:tomcat-catalina
>= 9.0.0.M1, < 9.0.119
Fixed in: 9.0.119
MAVEN / org.apache.tomcat:tomcat-catalina
>= 10.1.0-M1, < 10.1.56
Fixed in: 10.1.56
MAVEN / org.apache.tomcat:tomcat-catalina
>= 11.0.0-M1, < 11.0.23
Fixed in: 11.0.23
MAVEN / org.apache.tomcat:tomcat
<= 7.0.109
MAVEN / org.apache.tomcat:tomcat
>= 8.5.0, <= 8.5.100
MAVEN / org.apache.tomcat:tomcat
>= 9.0.0.M1, < 9.0.119
Fixed in: 9.0.119
MAVEN / org.apache.tomcat:tomcat
>= 10.1.0-M1, < 10.1.56
Fixed in: 10.1.56
MAVEN / org.apache.tomcat:tomcat
>= 11.0.0-M1, < 11.0.23
Fixed in: 11.0.23

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Apache Tomcat: Security constraints for default servlet ignored method

AFFECTED PACKAGES:
Unknown / Unknown
ALIASES:
BIT-tomcat-2026-55956

> HISTORIQUE DES MODIFICATIONS

Première apparition
29/06/2026 21:16
Source: NVD
📊 ENRICHISSEMENT 01/07/2026 06:01
CWE
Champ modifié: Description CWE
Ancienne valeur:
N/A
Nouvelle valeur:
CWE-285: Improper Authorization - The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Total des modifications: 1 Dernière mise à jour: 4 months ago

> REFERENCES

https://lists.apache.org/thread/dcjdcnnnww9hhdm016hr0l7hpw1bzjfp
« BACK_TO_HOME