CVE-2026-55956: Apache Tomcat improper authorization in default servlet

CVE-2026-55956 · Severity: medium · CVSS 6.5 · Published 2026-06-29

Apache Tomcat, a widely used web server and application container, contains a flaw in how it handles security rules for its default file-serving component. This vulnerability could allow unauthorized users to bypass intended access restrictions on certain web resources. Organizations should upgrade to the latest patched versions to ensure their security policies are correctly enforced.

Technologies: org.apache.tomcat:tomcat (Maven), org.apache.tomcat:tomcat-catalina (Maven), org.apache.tomcat.embed:tomcat-embed-core (Maven). Vendors: Maven.

Quick answers

Is CVE-2026-55956 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55956 being exploited in the wild.
How severe is CVE-2026-55956?
Medium severity, with a CVSS score of 6.5, published 29 June 2026.
Which products and versions are affected?
org.apache.tomcat:tomcat (Maven) >= 11.0.0-M1, < 11.0.23, ECOSYSTEM:introduced=11.0.0-M1,fixed=11.0.23; org.apache.tomcat:tomcat-catalina (Maven) >= 11.0.0-M1, < 11.0.23, ECOSYSTEM:introduced=11.0.0-M1,fixed=11.0.23; org.apache.tomcat.embed:tomcat-embed-core (Maven) >= 11.0.0-M1, < 11.0.23, ECOSYSTEM:introduced=11.0.0-M1,fixed=11.0.23.
Is there a fix for CVE-2026-55956?
Yes. org.apache.tomcat:tomcat (Maven): upgrade to 11.0.23 or later; org.apache.tomcat:tomcat-catalina (Maven): upgrade to 11.0.23 or later; org.apache.tomcat.embed:tomcat-embed-core (Maven): upgrade to 11.0.23 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55956 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-55956?
Check whether you run org.apache.tomcat:tomcat (Maven), org.apache.tomcat:tomcat-catalina (Maven) or org.apache.tomcat.embed:tomcat-embed-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.tomcat:tomcat (Maven): upgrade to 11.0.23 or later
    # set org.apache.tomcat:tomcat to 11.0.23 in your pom.xml or build.gradle
  • org.apache.tomcat:tomcat-catalina (Maven): upgrade to 11.0.23 or later
    # set org.apache.tomcat:tomcat-catalina to 11.0.23 in your pom.xml or build.gradle
  • org.apache.tomcat.embed:tomcat-embed-core (Maven): upgrade to 11.0.23 or later
    # set org.apache.tomcat.embed:tomcat-embed-core to 11.0.23 in your pom.xml or build.gradle

Technical details

An improper authorization vulnerability (CWE-285) exists in Apache Tomcat's default servlet. The root cause is a failure to correctly process security constraints that specify HTTP methods or method omissions. When these constraints are applied to the default servlet, the server may ignore the method-specific restrictions, potentially allowing unauthorized access to protected resources via unvalidated HTTP methods. The vulnerability is reachable over the network without prior authentication. Patches are available in versions 11.0.23, 10.1.56, and 9.0.119.

Affected products

  • Apache Tomcat 11.0.0-M1 to 11.0.22, 10.1.0-M1 to 10.1.55, 9.0.0.M1 to 9.0.118, 8.5.0 to 8.5.100, 7.0.0 to 7.0.109

Identifiers

  • CVE-2026-55956
  • BIT-TOMCAT-2026-55956
  • GHSA-5v3h-fjv2-54fg

Timeline

  • 2026-06-29: disclosed
  • 2026-06-29: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.