ORG.APACHE.TOMCAT.EMBED:TOMCAT-EMBED-CORE · CVE-2026-55956 · Package
FIX → 11.0.23 · 10.1.56 · 9.0.119
Security constraints set on the Tomcat default servlet ignore the HTTP methods or method omissions configured in them. An attacker may be able to use HTTP methods that the configuration was meant to block, reaching resources that should be restricted.
first public Jun 29, 2026 · 2 sources
Running Org.apache.tomcat.embed:tomcat-embed-core? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Applications running Apache Tomcat that use security constraints with HTTP method restrictions on resources served by the default servlet are exposed. Applications without such constraints, or with the affected constraints only on paths handled by their own servlets, are less likely to be affected. Teams on Tomcat 8.5 or 7.x have no fixed version in the sources and should check with the vendor.
Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.
Not affected if default-servlet-unused, no-method-constraints
Who cares cwe-285, java, maven, self-hosted, tomcat
<security-constraint> entries in web.xml or the application's configuration that restrict HTTP methods on paths served by the default servlet.catalina.sh version and compare it against the fixed versions.org.apache.tomcat.embed:tomcat-embed-core, in pom.xml or the dependency lock file.Upgrade to 11.0.23 · 10.1.56 · 9.0.119
11.0.2310.1.569.0.119Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-55956") · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.