Apache Tomcat 9.x Multiple Low/Moderate Flaws — Default Servlet Constraint Bypass

Tenable plugin 323714 bundles six CVEs disclosed 2026-06-23, all fixed in Apache Tomcat 9.0.119. The headliner driving the Critical/9.1 rating is CVE-2026-53434 — invalid CRL configurations silently ignored on the FFM (Foreign Function & Memory) connector, theoretically letting revoked client certificates through. The remaining five are: CVE-2026-55956 (Moderate, CVSS 6.5) — method-scoped security constraints on the default servlet are collapsed, bypassing per-HTTP-method authorization; CVE-2026-55955 (Low) — EncryptInterceptor replay in cluster mode; CVE-2026-53404 (Low) — RewriteValve ornext logic flaw; CVE-2026-55276 (Low) — effective web.xml logging omits special roles (no runtime impact); and CVE-2026-50229 (Low) — reflected XSS in the bundled examples webapp. Affected: Tomcat 9.0.0.M1 through 9.0.118 (and parallel ranges on 10.1.x, 11.0.x; 8.5.x and 7.0.x are EOL with no fix).

The Tenable plugin inherits the CVSS 9.1 from NVD's scoring of CVE-2026-53434, but Apache themselves rate every CVE in this bundle Low except one Moderate (CVE-2026-55956 at 6.5). Tenable's own VPR is 4.3 (Medium), which much better reflects reality. The 9.1 score assumes an attacker can simply walk up to a network-facing FFM connector using mutual TLS with CRL checking — but the FFM connector requires Java 22+ and the Foreign Function API, which is experimental and virtually nonexistent in production Tomcat 9 deployments. The actually-reachable risk is CVE-2026-55956: if you rely on per-method constraints on the default servlet (uncommon), an attacker bypasses them. That is a real but narrow authorization flaw, not a Critical-class vulnerability.

1. Remove the examples webapp immediately — Delete $CATALINA_HOME/webapps/examples/ to eliminate CVE-2026-50229 (XSS). This is standard CIS Benchmark guidance and should already be done. Takes <1 minute per host, scriptable fleet-wide. No SLA pressure — this is hygiene.
2. Audit default servlet security constraints — Review all web.xml files for <security-constraint> elements targeting the default servlet path. If method-based restrictions exist (e.g., <http-method>PUT</http-method>), understand that these are not enforced as written until 9.0.119. Consider moving access control to a WAF or application framework (Spring Security) as the primary enforcement point. Per the noisgate MEDIUM remediation SLA, patch to 9.0.119 within 365 days.
3. Verify FFM connector is not in use — Check server.xml for any <Connector> using the FFM protocol handler (org.apache.coyote.http11.Http11Nio2Protocol with FFM bindings or tomcat-coyote-ffm dependency). If FFM is not configured — which is the case for >99% of Tomcat 9 deployments — CVE-2026-53434 does not apply. Document the finding.
4. Validate cluster EncryptInterceptor configuration — If Tomcat clustering is enabled with <Interceptor className="org.apache.catalina.tribes.group.interceptors.EncryptInterceptor"/>, ensure the cluster network is isolated to a dedicated VLAN or network segment. CVE-2026-55955 requires attacker presence on the cluster network to replay encrypted messages.
5. Upgrade to Tomcat 9.0.119+ within the remediation window — Apply the vendor patch as your remediation action. Per the noisgate MEDIUM remediation SLA, complete the upgrade within 365 days. No mitigation SLA applies — go straight to the remediation window. Prioritize instances with default servlet constraints or cluster configurations.

Run this script on each Tomcat host as any user with read access to the Tomcat installation directory. Invoke with: bash check_tomcat_323714.sh /opt/tomcat (pass CATALINA_HOME as the first argument). No root required.

#!/usr/bin/env bash
# check_tomcat_323714.sh — Tenable plugin 323714 verification
# Checks Apache Tomcat 9.x version against the fix threshold (9.0.119)
# Usage: bash check_tomcat_323714.sh /path/to/catalina_home
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

CATALINA_HOME="${1:-${CATALINA_HOME:-}}"

if [[ -z "$CATALINA_HOME" ]]; then
  echo "UNKNOWN — CATALINA_HOME not provided. Usage: $0 /path/to/tomcat"
  exit 2
fi

# Try version.sh first
if [[ -x "$CATALINA_HOME/bin/version.sh" ]]; then
  VERSION_OUTPUT=$("$CATALINA_HOME/bin/version.sh" 2>/dev/null || true)
  VERSION=$(echo "$VERSION_OUTPUT" | grep -oP 'Server number:\s*\K[0-9]+\.[0-9]+\.[0-9]+' | head -1)
fi

# Fallback: read from catalina.jar MANIFEST
if [[ -z "${VERSION:-}" && -f "$CATALINA_HOME/lib/catalina.jar" ]]; then
  VERSION=$(unzip -p "$CATALINA_HOME/lib/catalina.jar" META-INF/MANIFEST.MF 2>/dev/null \
    | grep -oP 'Implementation-Version:\s*\K[0-9]+\.[0-9]+\.[0-9]+' | head -1)
fi

if [[ -z "${VERSION:-}" ]]; then
  echo "UNKNOWN — Could not determine Tomcat version from $CATALINA_HOME"
  exit 2
fi

echo "Detected Tomcat version: $VERSION"

# Parse major.minor.patch
IFS='.' read -r MAJOR MINOR PATCH <<< "$VERSION"

# Only applies to Tomcat 9.x
if [[ "$MAJOR" -ne 9 ]]; then
  echo "UNKNOWN — This check targets Tomcat 9.x only (found $MAJOR.x)"
  exit 2
fi

# Fixed in 9.0.119
if [[ "$MINOR" -eq 0 && "$PATCH" -ge 119 ]]; then
  echo "PATCHED — Tomcat $VERSION >= 9.0.119 (plugin 323714 does not apply)"
  exit 0
elif [[ "$MINOR" -gt 0 ]]; then
  echo "PATCHED — Tomcat $VERSION > 9.0.x (plugin 323714 does not apply)"
  exit 0
else
  echo "VULNERABLE — Tomcat $VERSION < 9.0.119 (affected by plugin 323714)"
  # Additional context checks
  if [[ -d "$CATALINA_HOME/webapps/examples" ]]; then
    echo "  WARNING: examples webapp present (CVE-2026-50229 XSS risk)"
  fi
  if grep -qr 'EncryptInterceptor' "$CATALINA_HOME/conf/" 2>/dev/null; then
    echo "  WARNING: EncryptInterceptor configured (CVE-2026-55955 replay risk)"
  fi
  if grep -qr 'tomcat-coyote-ffm\|org.apache.tomcat.util.net.openssl.panama' "$CATALINA_HOME/conf/" "$CATALINA_HOME/lib/" 2>/dev/null; then
    echo "  WARNING: FFM connector artifacts detected (CVE-2026-53434 CRL risk)"
  fi
  exit 1
fi

1. Tenable Plugin 323714
2. Apache Tomcat 9 Security Advisories
3. HeroDevs — Apache Tomcat CVE Round-Up June 2026
4. CVE-2026-55956 Detail — OpenCVE
5. CVE-2026-53434 — Feedly Threat Intel
6. CVE-2026-55955 — oss-security advisory
7. CVE-2026-50229 — Red Hat Advisory
8. NVD — CVE-2026-55956