Loading vulnerability…
Apache Tomcat Default Servlet Security Constraint Bypass
CVE-2026-55956 is an improper authorization vulnerability in Apache Tomcat's default servlet. Security constraints specified for the servlet ignore configured HTTP methods or method omissions, undermining method-based authorization policy and potentially permitting security-constraint bypass. Affected versions are 11.0.0-M1 through 11.0.22, 10.1.0-M1 through 10.1.55, 9.0.0.M1 through 9.0.118, 8.5.0 through 8.5.100, and 7.0.0 through 7.0.109. Other end-of-support versions may also be affected. Apache rates the vulnerability Moderate.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker may bypass intended authorization restrictions and access resources handled by the default servlet contrary to the configured HTTP-method policy. The extent of unauthorized access depends on the application's security constraints and the resources exposed through the servlet. Code execution, denial of service, and broader system compromise are not established for this vulnerability.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is identified; upgrading is the recommended corrective action.
Patch, then assume compromise.
Upgrade Apache Tomcat to 11.0.23, 10.1.56, or 9.0.119, or a later fixed release in the corresponding branch. For affected 7.0 and 8.5 deployments, migrate to a supported, fixed branch; no fixed releases for those branches are identified. Vendor-packaged deployments should install the applicable vendor security update containing the fix. After upgrading, review and test default-servlet security constraints to verify that HTTP-method restrictions and omissions behave as intended.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
32 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.