---
id: "CVE-2026-55276"
kind: "vulnerability"
aliases: ["CVE-2026-55276", "GHSA-mqg3-r7h5-24x4"]
title: "Apache Tomcat has an Always-Incorrect Control Flow Implementation vulnerability"
severity: "critical"
cvss: 9.1
epss: 0.00607
exploited: false
status: "open"
category: "runtime"
products: [{"name": "org.apache.tomcat.embed:tomcat-embed-core", "fixed": ["11.0.23"], "affected": ">= 11.0.0-M1, < 11.0.23", "ecosystem": "maven"}, {"name": "org.apache.tomcat.embed:tomcat-embed-core", "fixed": ["10.1.56"], "affected": ">= 10.1.0-M1, < 10.1.56", "ecosystem": "maven"}, {"name": "org.apache.tomcat.embed:tomcat-embed-core", "fixed": ["9.0.119"], "affected": ">= 9.0.0.M1, < 9.0.119", "ecosystem": "maven"}, {"name": "org.apache.tomcat.embed:tomcat-embed-core", "fixed": [], "affected": ">= 8.5.0, <= 8.5.100", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat", "fixed": ["11.0.23"], "affected": ">= 11.0.0-M1, < 11.0.23", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat", "fixed": ["10.1.56"], "affected": ">= 10.1.0-M1, < 10.1.56", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat", "fixed": ["9.0.119"], "affected": ">= 9.0.0.M1, < 9.0.119", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat", "fixed": [], "affected": ">= 8.5.0, <= 8.5.100", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat-util-scan", "fixed": ["11.0.23"], "affected": ">= 11.0.0-M1, < 11.0.23", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat-util-scan", "fixed": ["10.1.56"], "affected": ">= 10.1.0-M1, < 10.1.56", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat-util-scan", "fixed": ["9.0.119"], "affected": ">= 9.0.0.M1, < 9.0.119", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat-util-scan", "fixed": [], "affected": ">= 8.5.0, <= 8.5.100", "ecosystem": "maven"}]
ecosystems: ["maven"]
tags: ["cwe-670", "java", "maven", "runtime", "self-hosted", "tomcat"]
not_affected_if: ["already-on-fixed-version"]
published_at: "2026-06-29T21:32:15+00:00"
first_seen_at: "2026-11-04T16:44:44+00:00"
updated_at: "2026-11-04T16:45:11+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-mqg3-r7h5-24x4", "first_seen_at": "2026-11-04T16:44:44+00:00"}]
---

# Apache Tomcat has an Always-Incorrect Control Flow Implementation vulnerability

Apache Tomcat did not include special roles and empty authorisation constraints when it logged the effective web.xml. The sources describe this as a control flow implementation flaw (CWE-670) and give a CVSS score of 9.1, but do not state what an attacker can do with it.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:org.apache.tomcat.embed:tomcat-embed-core affected >= 11.0.0-M1, < 11.0.23 fixed 11.0.23
- maven:org.apache.tomcat.embed:tomcat-embed-core affected >= 10.1.0-M1, < 10.1.56 fixed 10.1.56
- maven:org.apache.tomcat.embed:tomcat-embed-core affected >= 9.0.0.M1, < 9.0.119 fixed 9.0.119
- maven:org.apache.tomcat.embed:tomcat-embed-core affected >= 8.5.0, <= 8.5.100 fixed ?
- maven:org.apache.tomcat:tomcat affected >= 11.0.0-M1, < 11.0.23 fixed 11.0.23
- maven:org.apache.tomcat:tomcat affected >= 10.1.0-M1, < 10.1.56 fixed 10.1.56
- maven:org.apache.tomcat:tomcat affected >= 9.0.0.M1, < 9.0.119 fixed 9.0.119
- maven:org.apache.tomcat:tomcat affected >= 8.5.0, <= 8.5.100 fixed ?
- maven:org.apache.tomcat:tomcat-util-scan affected >= 11.0.0-M1, < 11.0.23 fixed 11.0.23
- maven:org.apache.tomcat:tomcat-util-scan affected >= 10.1.0-M1, < 10.1.56 fixed 10.1.56
- maven:org.apache.tomcat:tomcat-util-scan affected >= 9.0.0.M1, < 9.0.119 fixed 9.0.119
- maven:org.apache.tomcat:tomcat-util-scan affected >= 8.5.0, <= 8.5.100 fixed ?

## How to check

- Check the Tomcat version in use, for example with `catalina.sh version` or the `tomcat-embed-core` version in the Maven dependency tree.
- Look for `tomcat-embed-core`, `tomcat` or `tomcat-util-scan` in the project's Maven dependencies.
- Confirm whether the version falls in 11.0.0-M1 to 11.0.22, 10.1.0-M1 to 10.1.55, 9.0.0.M1 to 9.0.118 or 8.5.0 to 8.5.100.

## Fix

- Tomcat 11.x: upgrade to `11.0.23`
- Tomcat 10.1.x: upgrade to `10.1.56`
- Tomcat 9.0.x: upgrade to `9.0.119`
- Tomcat 8.5.x: unknown; the sources list no fixed version for 8.5 and say other end-of-support versions may also be affected

## Timeline

- 2026-11-04T16:44:44+00:00 ghsa https://github.com/advisories/GHSA-mqg3-r7h5-24x4

## Documents

- [fix] Patch: github.com https://github.com/apache/tomcat/commit/3ca8cae5fd3796b1bd9759e11b0e238161e7a39c
- [fix] Patch: github.com https://github.com/apache/tomcat/commit/e391c6b201eae2ad9707a1335aff68ab8b3e0f84
- [fix] Patch: github.com https://github.com/apache/tomcat/commit/f844614c6d92eeb11e81e179606bf4c390f642dd

## From the sources

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_