- 205/2026
- Critical
Apache Tomcat has released a security update to address several vulnerabilities affecting Apache Tomcat.
The addressed vulnerabilities could allow the attacker to perform cross-site scripting attacks or bypass security restrictions on the affected system.
Sample of the addressed vulnerabilities:
1. Apache Tomcat Invalid CRL Configuration Vulnerability (CVE-2026-53434):
- CVSS: 9.1
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Consequences: Bypass Security
2. Apache Tomcat Number Guess Example Cross-Site Scripting Vulnerability (CVE-2026-50229):
- CVSS: 6.1
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Consequences: Cross-Site Scripting
Vulnerabilities
- CVE-2026-50229
- CVE-2026-53404
- CVE-2026-53434
- CVE-2026-55276
- CVE-2026-55955
- CVE-2026-55956
Mitigations
The enterprise should deploy this patch as soon as the testing phase is completed.