Executive brief
Apache Tomcat, a widely used web server for Java applications, contains a logging flaw where certain security configurations are omitted from diagnostic logs. Specifically, when the server logs its effective configuration, it fails to include special user roles and empty authorization constraints. While this does not directly allow an attacker to break into the system, it can mislead administrators during security audits or troubleshooting, potentially hiding the true security posture of the application.
Technical details
An 'Always-Incorrect Control Flow Implementation' (CWE-670) exists in Apache Tomcat's configuration logging mechanism. When the server generates a log of the effective web.xml (the merged configuration used at runtime), it fails to include specific security elements, namely special roles and empty authorization constraints. This is a diagnostic/logging integrity issue rather than a direct bypass of runtime enforcement. An attacker cannot trigger this to gain unauthorized access, but it impacts the ability of security engineers to verify the active security constraints via logs. The issue is resolved in versions 11.0.23, 10.1.56, and 9.0.119.
Affected products
- Apache Tomcat 11.0.0-M1 to 11.0.22, 10.1.0-M1 to 10.1.55, 9.0.0.M1 to 9.0.118, 8.5.0 to 8.5.100
Timeline
- 2026-06-29: disclosed
- 2026-06-29: advisory