---
id: "CVE-2026-55956"
kind: "vulnerability"
aliases: ["CVE-2026-55956", "GHSA-5v3h-fjv2-54fg"]
title: "Apache Tomcat has an Improper Authorization vulnerability"
severity: "medium"
cvss: 6.5
epss: 0.00695
exploited: false
status: "open"
category: "package"
products: [{"name": "org.apache.tomcat.embed:tomcat-embed-core", "fixed": ["11.0.23"], "affected": ">= 11.0.0-M1, < 11.0.23", "ecosystem": "maven"}, {"name": "org.apache.tomcat.embed:tomcat-embed-core", "fixed": ["10.1.56"], "affected": ">= 10.1.0-M1, < 10.1.56", "ecosystem": "maven"}, {"name": "org.apache.tomcat.embed:tomcat-embed-core", "fixed": ["9.0.119"], "affected": ">= 9.0.0.M1, < 9.0.119", "ecosystem": "maven"}, {"name": "org.apache.tomcat.embed:tomcat-embed-core", "fixed": [], "affected": ">= 8.5.0, <= 8.5.100", "ecosystem": "maven"}, {"name": "org.apache.tomcat.embed:tomcat-embed-core", "fixed": [], "affected": "<= 7.0.109", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat", "fixed": ["11.0.23"], "affected": ">= 11.0.0-M1, < 11.0.23", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat", "fixed": ["10.1.56"], "affected": ">= 10.1.0-M1, < 10.1.56", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat", "fixed": ["9.0.119"], "affected": ">= 9.0.0.M1, < 9.0.119", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat", "fixed": [], "affected": ">= 8.5.0, <= 8.5.100", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat", "fixed": [], "affected": "<= 7.0.109", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat-catalina", "fixed": ["11.0.23"], "affected": ">= 11.0.0-M1, < 11.0.23", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat-catalina", "fixed": ["10.1.56"], "affected": ">= 10.1.0-M1, < 10.1.56", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat-catalina", "fixed": ["9.0.119"], "affected": ">= 9.0.0.M1, < 9.0.119", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat-catalina", "fixed": [], "affected": ">= 8.5.0, <= 8.5.100", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat-catalina", "fixed": [], "affected": "<= 7.0.109", "ecosystem": "maven"}, {"name": "apache tomcat", "fixed": ["9.0.119"], "affected": "< 9.0.119", "ecosystem": "vendor"}, {"name": "apache tomcat", "fixed": ["10.1.56"], "affected": ">= 10.1.0, < 10.1.56", "ecosystem": "vendor"}, {"name": "apache tomcat", "fixed": ["11.0.23"], "affected": ">= 11.0.0, < 11.0.23", "ecosystem": "vendor"}]
ecosystems: ["maven", "vendor"]
tags: ["cwe-285", "java", "maven", "package", "self-hosted", "tomcat"]
not_affected_if: ["default-servlet-unused", "no-method-constraints"]
published_at: "2026-06-29T21:16:45+00:00"
first_seen_at: "2026-11-04T16:24:15+00:00"
updated_at: "2026-11-04T16:28:16+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-5v3h-fjv2-54fg", "first_seen_at": "2026-11-04T16:24:15+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55956", "first_seen_at": "2026-11-04T16:28:16+00:00"}]
---

# Apache Tomcat has an Improper Authorization vulnerability

Security constraints set on the Tomcat default servlet ignore the HTTP methods or method omissions configured in them. An attacker may be able to use HTTP methods that the configuration was meant to block, reaching resources that should be restricted.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:org.apache.tomcat.embed:tomcat-embed-core affected >= 11.0.0-M1, < 11.0.23 fixed 11.0.23
- maven:org.apache.tomcat.embed:tomcat-embed-core affected >= 10.1.0-M1, < 10.1.56 fixed 10.1.56
- maven:org.apache.tomcat.embed:tomcat-embed-core affected >= 9.0.0.M1, < 9.0.119 fixed 9.0.119
- maven:org.apache.tomcat.embed:tomcat-embed-core affected >= 8.5.0, <= 8.5.100 fixed ?
- maven:org.apache.tomcat.embed:tomcat-embed-core affected <= 7.0.109 fixed ?
- maven:org.apache.tomcat:tomcat affected >= 11.0.0-M1, < 11.0.23 fixed 11.0.23
- maven:org.apache.tomcat:tomcat affected >= 10.1.0-M1, < 10.1.56 fixed 10.1.56
- maven:org.apache.tomcat:tomcat affected >= 9.0.0.M1, < 9.0.119 fixed 9.0.119
- maven:org.apache.tomcat:tomcat affected >= 8.5.0, <= 8.5.100 fixed ?
- maven:org.apache.tomcat:tomcat affected <= 7.0.109 fixed ?
- maven:org.apache.tomcat:tomcat-catalina affected >= 11.0.0-M1, < 11.0.23 fixed 11.0.23
- maven:org.apache.tomcat:tomcat-catalina affected >= 10.1.0-M1, < 10.1.56 fixed 10.1.56
- maven:org.apache.tomcat:tomcat-catalina affected >= 9.0.0.M1, < 9.0.119 fixed 9.0.119
- maven:org.apache.tomcat:tomcat-catalina affected >= 8.5.0, <= 8.5.100 fixed ?
- maven:org.apache.tomcat:tomcat-catalina affected <= 7.0.109 fixed ?
- vendor:apache tomcat affected < 9.0.119 fixed 9.0.119
- vendor:apache tomcat affected >= 10.1.0, < 10.1.56 fixed 10.1.56
- vendor:apache tomcat affected >= 11.0.0, < 11.0.23 fixed 11.0.23

## How to check

- Look for `<security-constraint>` entries in `web.xml` or the application's configuration that restrict HTTP methods on paths served by the default servlet.
- Check the Tomcat version with `catalina.sh version` and compare it against the fixed versions.
- Check which Tomcat artifact your build uses, such as `org.apache.tomcat.embed:tomcat-embed-core`, in `pom.xml` or the dependency lock file.

## Fix

- Tomcat `11.0.23`
- Tomcat `10.1.56`
- Tomcat `9.0.119`
- Tomcat 8.5.x and 7.x: unknown, the sources list no fixed version.

## Timeline

- 2026-11-04T16:24:15+00:00 ghsa https://github.com/advisories/GHSA-5v3h-fjv2-54fg
- 2026-11-04T16:28:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-55956

## Documents

- [advisory] Vendor advisory: lists.apache.org https://lists.apache.org/thread/dcjdcnnnww9hhdm016hr0l7hpw1bzjfp
- [advisory] Third-party advisory: www.openwall.com http://www.openwall.com/lists/oss-security/2026/06/29/25
- [fix] Patch: github.com https://github.com/apache/tomcat/commit/3f6bd2ba5e53d1f340bbe5ad2d42a28b29440b7a
- [fix] Patch: github.com https://github.com/apache/tomcat/commit/9c3b1efb74fd04f77639720af1d48a8f664ad9bb
- [fix] Patch: github.com https://github.com/apache/tomcat/commit/a0374c450970760efafbd8806a1db278830ba7bd

## From the sources

Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_