Apache Tomcatにおける複数の脆弱性（2026年6月29日）

2026年6月29日）

The Apache Software Foundationから、Apache Tomcatの脆弱性（CVE-2026-55957, CVE-2026-55956, CVE-2026-55955, CVE-2026-55276, CVE-2026-53434, CVE-2026-53404, CVE-2026-50229）に対してアドバイザリが公開されました。

Apache Tomcatのアドバイザリを参照してください。

Fixed in Apache Tomcat 11.0.23
Fixed in Apache Tomcat 11.0.5
Fixed in Apache Tomcat 10.1.56
Fixed in Apache Tomcat 10.1.39
Fixed in Apache Tomcat 9.0.119
Fixed in Apache Tomcat 9.0.102

Apache Tomcatのアドバイザリを参照してください。

Apache Tomcatのアドバイザリを参照してください。

ベンダ

リンク

The Apache Software Foundation

[SECURITY] CVE-2026-55957 Apache Tomcat – Authentication bypass with JNDIRealm and GSSAPI authenticated bind

[SECURITY] CVE-2026-55956 Apache Tomcat – Security constraints for default servlet ignored method

[SECURITY] CVE-2026-55955 Apache Tomcat – EncryptInterceptor not protected against replay attacks

[SECURITY] CVE-2026-55276 Apache Tomcat – Logged effective web.xml is incomplete

[SECURITY] CVE-2026-53434 Apache Tomcat – Invalid CRL configuration doesn’t trigger failure for FFM Connector

[SECURITY] CVE-2026-53404 Apache Tomcat – Bad ornext processing in RewriteValve

[SECURITY] CVE-2026-50229 Apache Tomcat – XXS in number guess example

Fixed in Apache Tomcat 11.0.23

Fixed in Apache Tomcat 11.0.5

Fixed in Apache Tomcat 10.1.56

Fixed in Apache Tomcat 10.1.39

Fixed in Apache Tomcat 9.0.119

Fixed in Apache Tomcat 9.0.102

JPCERT 緊急報告

JPCERT REPORT

CERT Advisory

CPNI Advisory

TRnotes

CVE

JVN iPedia

Copyright (c) 2000-2026 JPCERT/CC and IPA. All rights reserved.

出典: jvn@jvn.jp
URL: https://jvn.jp/vu/JVNVU93304382/