Bug 2494675 (CVE-2026-55276)

Summary:	CVE-2026-55276 tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	csutherl, dsoumis, jclere, jwon, pjindal, plodge, rhel-process-autobot, rmaucher, szappis, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Apache Tomcat. Due to an always-incorrect control flow implementation, special roles and empty authorization constraints were not accurately included when the effective web.xml configuration was logged. This could lead to a security oversight where administrators might misinterpret the actual authorization constraints, potentially impacting the security posture of the application.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2494717
Bug Blocks:

Description OSIDB Bzimport 2026-06-29 21:02:37 UTC

Always-Incorrect Control Flow Implementation vulnerability in Apache Tomcat meant that special roles and empty authorisation constraints were not included when the effective web.xml was logged.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100. Other versions that have reached end of support may also be affected.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119 which fixes the issue.

Comment 2 errata-xmlrpc 2026-08-05 13:11:44 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Web Server 7.0.1

Via RHSA-2026:49952 https://access.redhat.com/errata/RHSA-2026:49952

Comment 3 errata-xmlrpc 2026-08-05 13:12:29 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Web Server 7.0 on RHEL 10
  Red Hat JBoss Web Server 7.0 on RHEL 8
  Red Hat JBoss Web Server 7.0 on RHEL 9

Via RHSA-2026:49951 https://access.redhat.com/errata/RHSA-2026:49951

Comment 4 Jon Orris 2026-10-01 16:24:08 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Web Server 6.2.5

Via RHSA-2026:73982 https://access.redhat.com/errata/RHSA-2026:73982

Comment 5 Jon Orris 2026-10-01 22:11:21 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Web Server 6.2 on RHEL 10
  Red Hat JBoss Web Server 6.2 on RHEL 8
  Red Hat JBoss Web Server 6.2 on RHEL 9

Via RHSA-2026:73981 https://access.redhat.com/errata/RHSA-2026:73981