Copyright © 2012 Red Hat, Inc. All rights reserved. Low 2026-06-29T20:42:23 tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow 2.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N CWE-778

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue.

A flaw was found in Apache Tomcat. Due to an always-incorrect control flow implementation, special roles and empty authorization constraints were not accurately included when the effective web.xml configuration was logged. This could lead to a security oversight where administrators might misinterpret the actual authorization constraints, potentially impacting the security posture of the application.

A flaw was found in Apache Tomcat. When the effective web.xml logging feature is enabled for debugging, special roles and empty authorization constraints may be omitted from the logged output. This is a logging-only issue with no runtime security impact — it only affects the accuracy of debug log output for administrators reviewing the effective web.xml configuration. This is a logging-only issue with no runtime security impact. No mitigation is required. Administrators should not rely solely on the effective web.xml debug log output to verify security constraint configuration. Red Hat Hardened Images 2026-06-24T00:00:00Z RHSA-2026:29203 tomcat10-main-10.1.56-1.hum1 Red Hat Hardened Images 2026-06-29T00:00:00Z RHSA-2026:32960 tomcat11-main-11.0.23-0.1.hum1 Red Hat Enterprise Linux 10 Fix deferred tomcat Red Hat Enterprise Linux 10 Fix deferred tomcat9 Red Hat Enterprise Linux 6 Fix deferred tomcat6 Red Hat Enterprise Linux 7 Fix deferred tomcat Red Hat Enterprise Linux 8 Fix deferred pki-deps:10.6/pki-servlet-engine Red Hat Enterprise Linux 8 Fix deferred tomcat Red Hat Enterprise Linux 9 Fix deferred pki-servlet-engine Red Hat Enterprise Linux 9 Fix deferred tomcat Red Hat JBoss Web Server 5 Fix deferred jws5-tomcat Red Hat JBoss Web Server 6 Affected tomcat-catalina Red Hat JBoss Web Server 7 Affected tomcat-catalina https://www.cve.org/CVERecord?id=CVE-2026-55276 https://nvd.nist.gov/vuln/detail/CVE-2026-55276 https://lists.apache.org/thread/jy09xjlzn6r2qwvqoph8vcmf959yq68v