CVE-2026-55276

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.22 Apache Tomcat versions 10.1.0-M1 through 10.1.55 Apache Tomcat versions 9.0.0.M1 through 9.0.118 Apache Tomcat versions 8.5.0 through 8.5.100

Description An always-incorrect control flow implementation causes special roles and empty authorization constraints to be omitted when the effective web.xml is logged. This faulty logic during effective descriptor logging results in inaccurate security-related logging, which can mislead auditors and defenders who rely on these logs for validation. Consequently, risky or unintended authorization behaviors may remain undetected during investigations and compliance checks.

Recommendations Upgrade to version 11.0.23 Upgrade to version 10.1.56 Upgrade to version 9.0.119