Executive brief
Apache Tomcat, a widely used web server and application container, contains a flaw in how it handles security rules for its default file-serving component. This vulnerability could allow unauthorized users to bypass intended access restrictions on certain web resources. Organizations should upgrade to the latest patched versions to ensure their security policies are correctly enforced.
Technical details
An improper authorization vulnerability (CWE-285) exists in Apache Tomcat's default servlet. The root cause is a failure to correctly process security constraints that specify HTTP methods or method omissions. When these constraints are applied to the default servlet, the server may ignore the method-specific restrictions, potentially allowing unauthorized access to protected resources via unvalidated HTTP methods. The vulnerability is reachable over the network without prior authentication. Patches are available in versions 11.0.23, 10.1.56, and 9.0.119.
Affected products
- Apache Tomcat 11.0.0-M1 to 11.0.22, 10.1.0-M1 to 10.1.55, 9.0.0.M1 to 9.0.118, 8.5.0 to 8.5.100, 7.0.0 to 7.0.109
Timeline
- 2026-06-29: disclosed
- 2026-06-29: advisory