CVE-2026-55276

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-55276
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55276.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-55276
Aliases
Downstream
Related
Published
2026-06-29T20:42:23.257Z
Modified
2026-07-08T08:13:49.405843884Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Apache Tomcat: Logged effective web.xml is incomplete
Details

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55276.json",
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-670"
    ],
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "11.0.0-M1"
                },
                {
                    "last_affected": "11.0.22"
                },
                {
                    "introduced": "10.1.0-M1"
                },
                {
                    "last_affected": "10.1.55"
                },
                {
                    "introduced": "9.0.0.M1"
                },
                {
                    "last_affected": "9.0.118"
                },
                {
                    "introduced": "8.5.0"
                },
                {
                    "last_affected": "8.5.100"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "introduced": "11.0.0-M1"
                },
                {
                    "fixed": "11.0.22"
                },
                {
                    "introduced": "10.1.0-M1"
                },
                {
                    "fixed": "10.1.55"
                },
                {
                    "introduced": "9.0.0.M1"
                },
                {
                    "fixed": "9.0.118"
                },
                {
                    "introduced": "8.5.0"
                },
                {
                    "fixed": "8.5.100"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}
References

Affected packages

Git / github.com/apache/tomcat

Affected ranges

Type
GIT
Repo
https://github.com/apache/tomcat
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
36c2e40f60e3176f12c0344f40f656251448b004
Introduced
e9d17cddc285615807ec5fef09240777436b25dc
Fixed
59f3f1ab4f905f94c9c99cad579d6afb3a935b66
Introduced
56e547d387ab49f688c93fe9ca082b1b5d94deed
Fixed
b5c1bba61f2e54875bd6d538ae145fffd7b217a8
Database specific 
{
    "cpe": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "9.0.119"
        },
        {
            "introduced": "10.1.0"
        },
        {
            "fixed": "10.1.56"
        },
        {
            "introduced": "11.0.0"
        },
        {
            "fixed": "11.0.23"
        }
    ],
    "source": "CPE_RANGE"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55276.json"