{"id":"CVE-2026-55276","kind":"vulnerability","aliases":["CVE-2026-55276","GHSA-mqg3-r7h5-24x4"],"related":[],"title":"Apache Tomcat has an Always-Incorrect Control Flow Implementation vulnerability","description":"Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.\n\nUsers are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue.","summary":"Apache Tomcat did not include special roles and empty authorisation constraints when it logged the effective web.xml. The sources describe this as a control flow implementation flaw (CWE-670) and give a CVSS score of 9.1, but do not state what an attacker can do with it.","severity":"critical","cvss":9.1,"epss":0.00607,"exploited":false,"exploited_at":null,"products":[{"name":"org.apache.tomcat.embed:tomcat-embed-core","fixed":["11.0.23"],"affected":">= 11.0.0-M1, < 11.0.23","ecosystem":"maven"},{"name":"org.apache.tomcat.embed:tomcat-embed-core","fixed":["10.1.56"],"affected":">= 10.1.0-M1, < 10.1.56","ecosystem":"maven"},{"name":"org.apache.tomcat.embed:tomcat-embed-core","fixed":["9.0.119"],"affected":">= 9.0.0.M1, < 9.0.119","ecosystem":"maven"},{"name":"org.apache.tomcat.embed:tomcat-embed-core","fixed":[],"affected":">= 8.5.0, <= 8.5.100","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat","fixed":["11.0.23"],"affected":">= 11.0.0-M1, < 11.0.23","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat","fixed":["10.1.56"],"affected":">= 10.1.0-M1, < 10.1.56","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat","fixed":["9.0.119"],"affected":">= 9.0.0.M1, < 9.0.119","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat","fixed":[],"affected":">= 8.5.0, <= 8.5.100","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat-util-scan","fixed":["11.0.23"],"affected":">= 11.0.0-M1, < 11.0.23","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat-util-scan","fixed":["10.1.56"],"affected":">= 10.1.0-M1, < 10.1.56","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat-util-scan","fixed":["9.0.119"],"affected":">= 9.0.0.M1, < 9.0.119","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat-util-scan","fixed":[],"affected":">= 8.5.0, <= 8.5.100","ecosystem":"maven"}],"ecosystems":["maven"],"tags":["cwe-670","java","maven","runtime","self-hosted","tomcat"],"not_affected_if":["already-on-fixed-version"],"how_to_check":"- Check the Tomcat version in use, for example with `catalina.sh version` or the `tomcat-embed-core` version in the Maven dependency tree.\n- Look for `tomcat-embed-core`, `tomcat` or `tomcat-util-scan` in the project's Maven dependencies.\n- Confirm whether the version falls in 11.0.0-M1 to 11.0.22, 10.1.0-M1 to 10.1.55, 9.0.0.M1 to 9.0.118 or 8.5.0 to 8.5.100.","fix":"- Tomcat 11.x: upgrade to `11.0.23`\n- Tomcat 10.1.x: upgrade to `10.1.56`\n- Tomcat 9.0.x: upgrade to `9.0.119`\n- Tomcat 8.5.x: unknown; the sources list no fixed version for 8.5 and say other end-of-support versions may also be affected","status":"open","published_at":"2026-06-29T21:32:15+00:00","first_seen_at":"2026-11-04T16:44:44+00:00","triaged_at":"2026-11-04T16:45:11+00:00","updated_at":"2026-11-04T16:45:11+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-04T16:45:11Z","model":"claude-haiku-5-5","output":{"fix":"- Tomcat 11.x: upgrade to `11.0.23`\n- Tomcat 10.1.x: upgrade to `10.1.56`\n- Tomcat 9.0.x: upgrade to `9.0.119`\n- Tomcat 8.5.x: unknown; the sources list no fixed version for 8.5 and say other end-of-support versions may also be affected","reach":"unknown","title":"Apache Tomcat: effective web.xml logging omits special roles and authorisation constraints","impact":"medium","summary":"Apache Tomcat did not include special roles and empty authorisation constraints when it logged the effective web.xml. The sources describe this as a control flow implementation flaw (CWE-670) and give a CVSS score of 9.1, but do not state what an attacker can do with it.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["tomcat","java","maven","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"unknown; the sources do not say what an attacker gains","analyst_note":"Confirm the attacker-facing impact and whether 8.5.x has a fix, using the GHSA-mqg3-r7h5-24x4 advisory and the linked patch pages.","how_to_check":"- Check the Tomcat version in use, for example with `catalina.sh version` or the `tomcat-embed-core` version in the Maven dependency tree.\n- Look for `tomcat-embed-core`, `tomcat` or `tomcat-util-scan` in the project's Maven dependencies.\n- Confirm whether the version falls in 11.0.0-M1 to 11.0.22, 10.1.0-M1 to 10.1.55, 9.0.0.M1 to 9.0.118 or 8.5.0 to 8.5.100.","plain_action":"","needs_analyst":true,"not_affected_if":["already-on-fixed-version"],"who_is_affected":"Any application that embeds or runs Apache Tomcat in the affected version ranges is in scope, through the tomcat-embed-core, tomcat and tomcat-util-scan Maven artifacts. The sources describe the flaw as affecting the logging of the effective web.xml, not request handling, so exposure depends on what an attacker can do with that logged output. Teams on 8.5.x have no fixed version listed and should treat the sources as incomplete for that branch.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000926,"input_tokens":4919,"output_tokens":868,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,21A '-55276':14A,22A '-670':72B,108B '10.1.0':161C '10.1.55':164C '10.1.56':194C '11.0.0':156C '11.0.22':159C '11.0.23':193C '24x4':19A '8.5.0':171C '8.5.100':173C '9.0.0':166C '9.0.118':169C '9.0.119':196C '9.1':115B 'affect':152C,185C 'also':183C 'alway':6A,124C 'always-incorrect':5A,123C 'apach':1A,80B,131C,153C 'attack':122B 'authoris':89B,139C 'constraint':90B,140C 'control':8A,103B,126C 'core':27A,32A,37A,42A 'cve':12A,20A 'cvss':112B 'cwe':71B,107B 'describ':99B 'effect':95B,146C 'embed':26A,31A,36A,41A 'empti':88B,138C 'end':179C 'fix':198C 'flaw':106B 'flow':9A,104B,127C 'ghsa':16A 'ghsa-mqg3-r7h5-24x4':15A 'give':110B 'host':78B 'implement':10A,105B,128C 'includ':84B,143C 'incorrect':7A,125C 'issu':151C,200C 'java':73B 'log':93B,149C 'm1':157C,162C,167C 'maven':74B 'may':182C 'meant':133C 'mqg3':17A 'org.apache.tomcat':43A,45A,47A,49A,51A,56A,61A,66A 'org.apache.tomcat.embed':23A,28A,33A,38A 'r7h5':18A 'reach':178C 'recommend':188C 'role':86B,136C 'runtim':75B 'scan':55A,60A,65A,70A 'score':113B 'self':77B 'self-host':76B 'sourc':98B 'special':85B,135C 'state':119B 'support':181C 'tomcat':2A,25A,30A,35A,40A,44A,46A,48A,50A,53A,58A,63A,68A,79B,81B,132C,154C 'tomcat-embed-core':24A,29A,34A,39A 'tomcat-util-scan':52A,57A,62A,67A 'upgrad':190C 'user':186C 'util':54A,59A,64A,69A 'version':175C,192C 'vulner':11A,129C 'web.xml':96B,147C","nicknames":[],"mitigations":[],"who_affected":"Any application that embeds or runs Apache Tomcat in the affected version ranges is in scope, through the tomcat-embed-core, tomcat and tomcat-util-scan Maven artifacts. The sources describe the flaw as affecting the logging of the effective web.xml, not request handling, so exposure depends on what an attacker can do with that logged output. Teams on 8.5.x have no fixed version listed and should treat the sources as incomplete for that branch.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["orgapachetomcatembedtomcatembedcore","orgapachetomcattomcat","orgapachetomcattomcatutilscan"],"ptokens":["apache","core","embed","org","scan","tomcat","util"],"labels":["critical","cwe670","java","maven","runtime","selfhosted","tomcat"],"campaign_type":null,"first_public_at":"2026-06-29T21:32:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-mqg3-r7h5-24x4","url":"https://github.com/advisories/GHSA-mqg3-r7h5-24x4","severity":"critical","published_at":"2026-06-29T21:32:15+00:00","modified_at":"2026-11-04T16:41:45+00:00","first_seen_at":"2026-11-04T16:44:44+00:00","fetched_at":"2026-11-04T16:44:44+00:00","note":null}],"documents":[{"id":68563,"url":"https://github.com/apache/tomcat/commit/3ca8cae5fd3796b1bd9759e11b0e238161e7a39c","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":68564,"url":"https://github.com/apache/tomcat/commit/e391c6b201eae2ad9707a1335aff68ab8b3e0f84","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":68565,"url":"https://github.com/apache/tomcat/commit/f844614c6d92eeb11e81e179606bf4c390f642dd","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}