{"id":"CVE-2026-55956","kind":"vulnerability","aliases":["CVE-2026-55956","GHSA-5v3h-fjv2-54fg"],"related":[],"title":"Apache Tomcat has an Improper Authorization vulnerability","description":"Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.\n\nUsers are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.","summary":"Security constraints set on the Tomcat default servlet ignore the HTTP methods or method omissions configured in them. An attacker may be able to use HTTP methods that the configuration was meant to block, reaching resources that should be restricted.","severity":"medium","cvss":6.5,"epss":0.00695,"exploited":false,"exploited_at":null,"products":[{"name":"org.apache.tomcat.embed:tomcat-embed-core","fixed":["11.0.23"],"affected":">= 11.0.0-M1, < 11.0.23","ecosystem":"maven"},{"name":"org.apache.tomcat.embed:tomcat-embed-core","fixed":["10.1.56"],"affected":">= 10.1.0-M1, < 10.1.56","ecosystem":"maven"},{"name":"org.apache.tomcat.embed:tomcat-embed-core","fixed":["9.0.119"],"affected":">= 9.0.0.M1, < 9.0.119","ecosystem":"maven"},{"name":"org.apache.tomcat.embed:tomcat-embed-core","fixed":[],"affected":">= 8.5.0, <= 8.5.100","ecosystem":"maven"},{"name":"org.apache.tomcat.embed:tomcat-embed-core","fixed":[],"affected":"<= 7.0.109","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat","fixed":["11.0.23"],"affected":">= 11.0.0-M1, < 11.0.23","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat","fixed":["10.1.56"],"affected":">= 10.1.0-M1, < 10.1.56","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat","fixed":["9.0.119"],"affected":">= 9.0.0.M1, < 9.0.119","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat","fixed":[],"affected":">= 8.5.0, <= 8.5.100","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat","fixed":[],"affected":"<= 7.0.109","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat-catalina","fixed":["11.0.23"],"affected":">= 11.0.0-M1, < 11.0.23","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat-catalina","fixed":["10.1.56"],"affected":">= 10.1.0-M1, < 10.1.56","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat-catalina","fixed":["9.0.119"],"affected":">= 9.0.0.M1, < 9.0.119","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat-catalina","fixed":[],"affected":">= 8.5.0, <= 8.5.100","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat-catalina","fixed":[],"affected":"<= 7.0.109","ecosystem":"maven"},{"name":"apache tomcat","fixed":["9.0.119"],"affected":"< 9.0.119","ecosystem":"vendor"},{"name":"apache tomcat","fixed":["10.1.56"],"affected":">= 10.1.0, < 10.1.56","ecosystem":"vendor"},{"name":"apache tomcat","fixed":["11.0.23"],"affected":">= 11.0.0, < 11.0.23","ecosystem":"vendor"}],"ecosystems":["maven","vendor"],"tags":["cwe-285","java","maven","package","self-hosted","tomcat"],"not_affected_if":["default-servlet-unused","no-method-constraints"],"how_to_check":"- Look for `<security-constraint>` entries in `web.xml` or the application's configuration that restrict HTTP methods on paths served by the default servlet.\n- Check the Tomcat version with `catalina.sh version` and compare it against the fixed versions.\n- Check which Tomcat artifact your build uses, such as `org.apache.tomcat.embed:tomcat-embed-core`, in `pom.xml` or the dependency lock file.","fix":"- Tomcat `11.0.23`\n- Tomcat `10.1.56`\n- Tomcat `9.0.119`\n- Tomcat 8.5.x and 7.x: unknown, the sources list no fixed version.","status":"open","published_at":"2026-06-29T21:16:45+00:00","first_seen_at":"2026-11-04T16:24:15+00:00","triaged_at":"2026-11-04T16:26:27+00:00","updated_at":"2026-11-04T16:28:16+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-04T16:26:27Z","model":"claude-haiku-5-5","output":{"fix":"- Tomcat `11.0.23`\n- Tomcat `10.1.56`\n- Tomcat `9.0.119`\n- Tomcat 8.5.x and 7.x: unknown, the sources list no fixed version.","reach":"network","title":"Apache Tomcat: default servlet ignores configured HTTP method security constraints","impact":"medium","summary":"Security constraints set on the Tomcat default servlet ignore the HTTP methods or method omissions configured in them. An attacker may be able to use HTTP methods that the configuration was meant to block, reaching resources that should be restricted.","audience":"businesses","category":"package","nicknames":[],"who_cares":["tomcat","java","self-hosted","maven"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Restricted HTTP methods on protected resources become reachable by remote clients","analyst_note":"Confirm whether any fixed release exists for Tomcat 8.5 and 7.x, and whether the GHSA advisory lists specific configurations that trigger it.","how_to_check":"- Look for `<security-constraint>` entries in `web.xml` or the application's configuration that restrict HTTP methods on paths served by the default servlet.\n- Check the Tomcat version with `catalina.sh version` and compare it against the fixed versions.\n- Check which Tomcat artifact your build uses, such as `org.apache.tomcat.embed:tomcat-embed-core`, in `pom.xml` or the dependency lock file.","plain_action":"","needs_analyst":true,"not_affected_if":["no-method-constraints","default-servlet-unused"],"who_is_affected":"Applications running Apache Tomcat that use security constraints with HTTP method restrictions on resources served by the default servlet are exposed. Applications without such constraints, or with the affected constraints only on paths handled by their own servlets, are less likely to be affected. Teams on Tomcat 8.5 or 7.x have no fixed version in the sources and should check with the vendor.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000858,"input_tokens":4890,"output_tokens":738,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':9A,17A '-285':81B '-55956':10A,18A '10.1.0':167C '10.1.55':170C '10.1.56':204C '11.0.0':162C '11.0.22':165C '11.0.23':203C '54fg':15A '5v3h':13A '7.0.0':181C '7.0.109':183C '8.5.0':177C '8.5.100':179C '9.0.0':172C '9.0.118':175C '9.0.119':206C 'abl':111B 'affect':158C,195C 'also':193C 'apach':1A,133C,159C 'apache':74A,76A,78A 'attack':108B 'author':6A,130C 'block':122B 'catalina':57A,61A,65A,69A,73A 'configur':104B,118B,150C 'constraint':90B,138C,155C 'core':23A,28A,33A,38A,43A 'cve':8A,16A 'cwe':80B 'default':95B,142C 'embed':22A,27A,32A,37A,42A 'end':189C 'fix':208C 'fjv2':14A 'ghsa':12A 'ghsa-5v3h-fjv2-54fg':11A 'host':87B 'http':99B,114B 'ignor':97B,144C 'improp':5A,129C 'issu':157C,210C 'java':82B 'lead':135C 'm1':163C,168C,173C 'maven':83B 'may':109B,192C 'meant':120B 'method':100B,102B,115B,146C,148C 'omiss':103B,149C 'org.apache.tomcat':44A,46A,48A,50A,52A,54A,58A,62A,66A,70A 'org.apache.tomcat.embed':19A,24A,29A,34A,39A 'packag':84B 'part':152C 'reach':123B,188C 'recommend':198C 'resourc':124B 'restrict':128B 'secur':89B,137C 'self':86B 'self-host':85B 'servlet':96B,143C 'set':91B 'specifi':139C 'support':191C 'tomcat':2A,21A,26A,31A,36A,41A,45A,47A,49A,51A,53A,56A,60A,64A,68A,72A,75A,77A,79A,88B,94B,134C,160C 'tomcat-catalina':55A,59A,63A,67A,71A 'tomcat-embed-core':20A,25A,30A,35A,40A 'upgrad':200C 'use':113B 'user':196C 'version':185C,202C 'vulner':7A,131C","nicknames":[],"mitigations":[],"who_affected":"Applications running Apache Tomcat that use security constraints with HTTP method restrictions on resources served by the default servlet are exposed. Applications without such constraints, or with the affected constraints only on paths handled by their own servlets, are less likely to be affected. Teams on Tomcat 8.5 or 7.x have no fixed version in the sources and should check with the vendor.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apachetomcat","orgapachetomcatembedtomcatembedcore","orgapachetomcattomcat","orgapachetomcattomcatcatalina","tomcat"],"ptokens":["apache","catalina","core","embed","org","tomcat"],"labels":["cwe285","java","maven","medium","package","selfhosted","tomcat","vendor"],"campaign_type":null,"first_public_at":"2026-06-29T21:16:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-5v3h-fjv2-54fg","url":"https://github.com/advisories/GHSA-5v3h-fjv2-54fg","severity":"medium","published_at":"2026-06-29T21:32:15+00:00","modified_at":"2026-11-04T16:19:56+00:00","first_seen_at":"2026-11-04T16:24:15+00:00","fetched_at":"2026-11-04T16:24:15+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-55956","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55956","severity":null,"published_at":"2026-06-29T21:16:45+00:00","modified_at":"2026-10-25T21:10:00+00:00","first_seen_at":"2026-11-04T16:28:16+00:00","fetched_at":"2026-11-04T16:28:16+00:00","note":null}],"documents":[{"id":68302,"url":"https://github.com/apache/tomcat/commit/3f6bd2ba5e53d1f340bbe5ad2d42a28b29440b7a","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":68303,"url":"https://github.com/apache/tomcat/commit/9c3b1efb74fd04f77639720af1d48a8f664ad9bb","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":68304,"url":"https://github.com/apache/tomcat/commit/a0374c450970760efafbd8806a1db278830ba7bd","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":68519,"url":"https://lists.apache.org/thread/dcjdcnnnww9hhdm016hr0l7hpw1bzjfp","title":"Vendor advisory: lists.apache.org","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: lists.apache.org"},{"id":68520,"url":"http://www.openwall.com/lists/oss-security/2026/06/29/25","title":"Third-party advisory: www.openwall.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.openwall.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}