Apache Tomcat Fixes Authentication, Authorization and AJP Security Flaws
Vulnerability Disclosure · 10 sources · Updated 2mo ago · First seen Jun 29, 2026
Apache Tomcat remediated a group of vulnerabilities affecting multiple supported release lines. CVE-2026-55957 allows authentication bypass in JNDIRealm deployments that use GSSAPI-authenticated binds, while CVE-2026-55956 can cause Default Servlet security constraints to incorrectly handle specified HTTP methods or method omissions. CVE-2026-55955 permits replay attacks against the cluster-component EncryptionInterceptor, and CVE-2026-43514 exposes a timing discrepancy in AJP secret comparison that may aid secret-value inference.
Tomcat also corrected CVE-2026-53434, in which invalid certificate-revocation-list configuration for an FFM-based connector might not produce an error, and CVE-2026-55276, where effective web.xml logging could omit special roles and empty authorization constraints. Organizations should upgrade affected deployments to supported fixed releases: generally Tomcat 11.0.23, 10.1.56, or 9.0.119 for the June issues; the JNDIRealm authentication-bypass advisory specifies 11.0.5, 10.1.37, or 9.0.101. Tomcat 8.0 and 8.5 are end of life and should be migrated to a supported branch rather than retained without security fixes.
