CVE-2026-55956: 
Apache Tomcat vulnerability analysis and mitigation

CVE-2026-55956 is an Improper Authorization vulnerability in Apache Tomcat where security constraints configured for the default servlet incorrectly ignore any HTTP method or method omission specified as part of the constraint. This allows unauthenticated remote attackers to bypass method-based access controls on protected resources. The vulnerability was disclosed on June 29, 2026, by researcher j0hndo (dohyun4466@gmail.com) and affects Apache Tomcat versions 11.0.0-M1 through 11.0.22, 10.1.0-M1 through 10.1.55, 9.0.0.M1 through 9.0.118, 8.5.0 through 8.5.100, and 7.0.0 through 7.0.109. It carries a CVSS v3.1 base score of 6.5 (Medium) (Apache Security Advisory, Github Advisory).

The root cause is classified as CWE-285 (Improper Authorization): when security constraints are applied to the default servlet in Tomcat's web.xml, any HTTP method restrictions or method omissions defined within those constraints are silently ignored by the servlet container. This means that even if an administrator configures a constraint to restrict access to specific HTTP methods (e.g., PUT, DELETE) or uses method omission syntax, the default servlet does not enforce these restrictions. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, making it automatable. No public proof-of-concept exploit code has been identified at this time (Apache Security Advisory, Github Advisory).

An unauthenticated remote attacker can bypass method-based security constraints on the default servlet, potentially reading sensitive files served by Tomcat and modifying or deleting protected resources depending on the server configuration. The confidentiality and integrity impacts are rated as low individually, but the combination of unauthorized read and write access to web-accessible resources could expose sensitive application data or allow unauthorized content modification. Availability is not directly impacted, and the scope is unchanged, limiting the blast radius to the affected Tomcat instance (Github Advisory, Apache Security Advisory).

1. Reconnaissance: Identify internet-facing Apache Tomcat instances running affected versions (11.0.0-M1–11.0.22, 10.1.0-M1–10.1.55, 9.0.0.M1–9.0.118, 8.5.0–8.5.100, 7.0.0–7.0.109) using tools like Shodan or Censys, or by fingerprinting HTTP response headers (e.g., Server: Apache-Coyote).
2. Identify default servlet-protected resources: Browse or enumerate paths served by the default servlet (static files, directories) that are expected to be restricted by method-based security constraints in web.xml.
3. Craft HTTP requests with restricted methods: Send HTTP requests using methods that should be blocked by the configured security constraints (e.g., PUT, DELETE, or methods specified in method-omission constraints) directly to the target resource URL.
4. Bypass authorization: Because the default servlet ignores the method restrictions in the security constraint, the request is processed without enforcing the configured access control, granting unauthorized read or write access to the protected resource.
5. Exfiltrate or modify data: Read sensitive files accessible via the default servlet, or upload/overwrite content if write methods are permitted by the underlying file system and Tomcat configuration (Apache Security Advisory, Github Advisory).

• Network: Unexpected HTTP requests using methods such as PUT, DELETE, or other non-standard verbs to paths that should be restricted; repeated access to static resource paths from unusual source IPs.
• Logs: Tomcat access logs (localhost_access_log) showing successful (2xx) responses to HTTP methods that should have been denied based on configured security constraints; absence of 403 responses where they would be expected for restricted methods.
• File System: Unexpected new or modified files in the Tomcat webapps directory or its subdirectories, particularly if PUT requests were used to upload content.
• Configuration: Review web.xml for <security-constraint> blocks targeting the default servlet with <http-method> or <http-method-omission> elements — these are the configurations that were not being enforced (Apache Security Advisory).

Apache has released patched versions addressing this vulnerability: 11.0.23, 10.1.56, and 9.0.119. Users running Tomcat 8.5.x (through 8.5.100) and 7.0.x (through 7.0.109) should be aware these branches have reached end-of-support and no official patches are provided; upgrading to a supported branch is strongly recommended. As an interim workaround, administrators should review and validate all security constraint configurations for the default servlet and consider removing method-specific restrictions until patching is complete, or restricting access to the default servlet via network-level controls. Upgrading to a patched version is the definitive remediation (Apache Security Advisory, Github Advisory).

The vulnerability was reported by security researcher j0hndo and disclosed by Apache's Mark Thomas via the oss-security mailing list on June 29, 2026 (Openwall oss-sec). Multiple security news outlets including CyberSecurityNews, GBHackers, and SecurityOnline covered the disclosure, framing it alongside a companion vulnerability (CVE-2026-55957) as part of a broader Apache Tomcat security update round. HeroDevs published a detailed vulnerability directory entry and a blog post summarizing seven Tomcat vulnerabilities disclosed in June 2026. Community sentiment on Bluesky and security aggregators noted the moderate severity but highlighted the wide version range affected and the automatable nature of exploitation.