ORG.APACHE.TOMCAT.EMBED:TOMCAT-EMBED-CORE · CVE-2026-55276 · Runtime
FIX → 11.0.23 · 10.1.56 · 9.0.119
Apache Tomcat did not include special roles and empty authorisation constraints when it logged the effective web.xml. The sources describe this as a control flow implementation flaw (CWE-670) and give a CVSS score of 9.1, but do not state what an attacker can do with it.
first public Jun 29, 2026 · 1 source
Running Org.apache.tomcat.embed:tomcat-embed-core? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Any application that embeds or runs Apache Tomcat in the affected version ranges is in scope, through the tomcat-embed-core, tomcat and tomcat-util-scan Maven artifacts. The sources describe the flaw as affecting the logging of the effective web.xml, not request handling, so exposure depends on what an attacker can do with that logged output. Teams on 8.5.x have no fixed version listed and should treat the sources as incomplete for that branch.
Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.
Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue.
Not affected if already-on-fixed-version
Who cares cwe-670, java, maven, self-hosted, tomcat
catalina.sh version or the tomcat-embed-core version in the Maven dependency tree.tomcat-embed-core, tomcat or tomcat-util-scan in the project's Maven dependencies.Upgrade to 11.0.23 · 10.1.56 · 9.0.119
11.0.2310.1.569.0.119This page as .md · .json · in your agent: get_signal("CVE-2026-55276") · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.