Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-06-29T20:46:02 tomcat: Apache Tomcat: Improper Authorization Allows Security Constraint Bypass 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CWE-551

Improper Authorization vulnerability in Apache Tomcat leads to security constraints specified for the default servlet ignoring any method or method omission configured as part of the constraint. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.

A flaw was found in Apache Tomcat where access control rules for the default servlet are improperly handled. An attacker can exploit this issue to bypass specific HTTP method restrictions, potentially gaining unauthorized access to protected application resources.

A security flaw in Apache Tomcat allows an attacker to bypass specific HTTP method restrictions on the default servlet. Red Hat products utilizing affected Tomcat versions are vulnerable if they rely on these method-specific security constraints. This could potentially enable unauthorized access to restricted application resources. Review your application's web.xml file. Ensure security constraints explicitly deny unauthorized users by path, rather than relying strictly on filtering specific HTTP methods (like GET or POST). Red Hat JBoss Web Server 7.0.0 2026-07-14T00:00:00Z RHSA-2026:39189 tomcat-catalina Red Hat JBoss Web Server 7.0 on RHEL 10 2026-07-14T00:00:00Z RHSA-2026:39188 jws7-tomcat-0:11.0.21-5.redhat_00004.1.el10jws Red Hat JBoss Web Server 7.0 on RHEL 8 2026-07-14T00:00:00Z RHSA-2026:39188 jws7-tomcat-0:11.0.21-5.redhat_00004.1.el8jws Red Hat JBoss Web Server 7.0 on RHEL 9 2026-07-14T00:00:00Z RHSA-2026:39188 jws7-tomcat-0:11.0.21-5.redhat_00004.1.el9jws Red Hat Hardened Images 2026-06-24T00:00:00Z RHSA-2026:29203 tomcat10-main-10.1.56-1.hum1 Red Hat Hardened Images 2026-06-29T00:00:00Z RHSA-2026:32960 tomcat11-main-11.0.23-0.1.hum1 Red Hat Enterprise Linux 10 Fix deferred tomcat Red Hat Enterprise Linux 10 Fix deferred tomcat9 Red Hat Enterprise Linux 6 Out of support scope tomcat6 Red Hat Enterprise Linux 7 Out of support scope tomcat Red Hat Enterprise Linux 8 Fix deferred pki-deps:10.6/pki-servlet-engine Red Hat Enterprise Linux 8 Fix deferred tomcat Red Hat Enterprise Linux 9 Fix deferred pki-servlet-engine Red Hat Enterprise Linux 9 Fix deferred tomcat Red Hat JBoss Web Server 5 Out of support scope jws5-tomcat Red Hat JBoss Web Server 6 Affected tomcat-catalina https://www.cve.org/CVERecord?id=CVE-2026-55956 https://nvd.nist.gov/vuln/detail/CVE-2026-55956 https://lists.apache.org/thread/dcjdcnnnww9hhdm016hr0l7hpw1bzjfp