Detections
Analytics

Apache Tomcat 11.0.0-M1 < 11.0.23 Multiple Vulnerabilities

critical Web App Scanning Plugin ID 115281

Synopsis

Apache Tomcat 11.0.0-M1 < 11.0.23 Multiple Vulnerabilities

Description

The version of Apache Tomcat installed on the remote host is 9.0.0-M1 prior to 9.0.119, 10.1.0-M1 prior to 10.1.56 or 11.0.0-M1 prior to 11.0.23. It is, therefore, affected by multiple vulnerabilities :

 - If security constraints were specified for the default servlet, any method or method omission configured as part of the constraint was ignored. (CVE-2026-55956)

 - Contrary to the documentation, the EncryptInterceptor was not protected against replay attacks. (CVE-2026-55955)

 - Logic errors in the effective web.xml generation meant that neither special roles nor empty authorization constraints were included in the logged effective web.xml. (CVE-2026-55276)

 - If an FFM connector was configured with invalid CRLs, the invalid CRLs were ignored meaning invalid certificates could be accepted. (CVE-2026-53434)

 - If a request matched the first condition in an OR chain in the RewriteValve, subsequent non-OR conditions were skipped and the rewrite succeeded. (CVE-2026-53404)

 - The use of wildcard property mapping resulted in some properties that were intended to be internal only being exposed to clients, allowing an XSS attack. (CVE-2026-50229)

Note that the scanner has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Apache Tomcat version 11.0.23 or later.

See Also

https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.23

Plugin Details

Severity: Critical

ID: 115281

Type: Version Based

Published: 7/3/2026

Updated: 7/3/2026

Scan Template: api, basic, full, pci, scan

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.64

CVSS v2

Risk Factor: High

Base Score: 9.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N

CVSS Score Source: CVE-2026-53434

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CVSS Score Source: CVE-2026-53434

Vulnerability Information

CPE: cpe:2.3:a:apache_software_foundation:tomcat:*:*:*:*:*:*:*:*

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 6/21/2026

Reference Information

CVE: CVE-2026-50229, CVE-2026-53404, CVE-2026-53434, CVE-2026-55276, CVE-2026-55955, CVE-2026-55956

CWE: 285, 287, 390, 670, 80

OWASP: 2010-A3, 2010-A4, 2013-A2, 2013-A4, 2013-A9, 2017-A2, 2017-A5, 2017-A9, 2021-A6, 2021-A7, 2025-A1, 2025-A10, 2025-A5, 2025-A6, 2025-A7

WASC: Cross-Site Scripting, Insufficient Authentication, Insufficient Authorization

CAPEC: 1, 104, 114, 115, 127, 13, 151, 17, 194, 22, 39, 402, 45, 5, 51, 57, 59, 593, 60, 633, 647, 650, 668, 76, 77, 87, 94

DISA STIG: APSC-DV-000460, APSC-DV-000500, APSC-DV-002630

HIPAA: 164.306(a)(1), 164.306(a)(2), 164.312(a)(1), 164.312(a)(2)(i)

ISO: 27001-A.13.1.1, 27001-A.14.1.2, 27001-A.14.1.3, 27001-A.14.2.5, 27001-A.18.1.3, 27001-A.6.2.2, 27001-A.9.1.2, 27001-A.9.4.1, 27001-A.9.4.4, 27001-A.9.4.5

NIST: sp800_53-AC-3, sp800_53-CM-6b, sp800_53-SC-24

OWASP API: 2019-API7, 2023-API8

OWASP ASVS: 4.0.2-14.2.1, 4.0.2-4.1.3

PCI-DSS: 3.2-2.2, 3.2-6.2, 3.2-6.5.10, 3.2-6.5.8