UnratedFix available

DEBIAN-CVE-2026-55957

Type: advisorySource: OSV1 source record

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.

Announced 29 Jun 2026Source revision 1

Original source ↗

DEBIAN-CVE-2026-55957

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:DEBIAN-CVE-2026-55957

tomcat10

Source reference: /affected/0/package/name

Affected versions: 10.1.10-1
Source reference: /affected/0/versions
10.1.13-1
Source reference: /affected/0/versions
10.1.14-1
Source reference: /affected/0/versions
10.1.15-1
Source reference: /affected/0/versions
10.1.16-1
Source reference: /affected/0/versions
10.1.20-1
Source reference: /affected/0/versions
10.1.23-1
Source reference: /affected/0/versions
10.1.25-1
Source reference: /affected/0/versions
10.1.25-1~bpo12+1
Source reference: /affected/0/versions
10.1.25-2
Source reference: /affected/0/versions
10.1.30-1
Source reference: /affected/0/versions
10.1.30-1~bpo12+1
Source reference: /affected/0/versions
10.1.31-1
Source reference: /affected/0/versions
10.1.33-1
Source reference: /affected/0/versions
10.1.33-1~bpo12+1
Source reference: /affected/0/versions
10.1.34-0+deb12u1
Source reference: /affected/0/versions
10.1.34-0+deb12u2
Source reference: /affected/0/versions
10.1.34-1
Source reference: /affected/0/versions
10.1.35-1
Source reference: /affected/0/versions
10.1.40-1
Source reference: /affected/0/versions
10.1.40-1~bpo12+1
Source reference: /affected/0/versions
10.1.46-1
Source reference: /affected/0/versions
10.1.6-1
Source reference: /affected/0/versions
10.1.6-1+deb12u1
Source reference: /affected/0/versions
10.1.6-1+deb12u2
Source reference: /affected/0/versions
10.1.7-1
Source reference: /affected/0/versions
10.1.8-1
Source reference: /affected/0/versions
10.1.9-1
Source reference: /affected/0/versions
Fixed versions: 10.1.52-1~deb12u1
Source reference: /affected/0/ranges
Prerequisites: Not stated in this record

tomcat10

Source reference: /affected/1/package/name

Affected versions: 10.1.40-1
Source reference: /affected/1/versions
10.1.46-1
Source reference: /affected/1/versions
10.1.52-1~deb12u1
Source reference: /affected/1/versions
Fixed versions: 10.1.52-1~deb13u1
Source reference: /affected/1/ranges
Prerequisites: Not stated in this record

tomcat10

Source reference: /affected/2/package/name

Affected versions: Not stated in this record
Fixed versions: 10.1.40-1
Source reference: /affected/2/ranges
Prerequisites: Not stated in this record

tomcat11

Source reference: /affected/3/package/name

Affected versions: 11.0.11-1
Source reference: /affected/3/versions
11.0.6-1
Source reference: /affected/3/versions
Fixed versions: 11.0.15-1~deb13u1
Source reference: /affected/3/ranges
Prerequisites: Not stated in this record

tomcat11

Source reference: /affected/4/package/name

Affected versions: Not stated in this record
Fixed versions: 11.0.5-1
Source reference: /affected/4/ranges
Prerequisites: Not stated in this record

tomcat9

Source reference: /affected/5/package/name

Affected versions: Not stated in this record
Fixed versions: 9.0.70-2
Source reference: /affected/5/ranges
Prerequisites: Not stated in this record

tomcat9

Source reference: /affected/6/package/name

Affected versions: Not stated in this record
Fixed versions: 9.0.70-2
Source reference: /affected/6/ranges
Prerequisites: Not stated in this record

tomcat9

Source reference: /affected/7/package/name

Affected versions: Not stated in this record
Fixed versions: 9.0.70-2
Source reference: /affected/7/ranges
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "10.1.52-1~deb12u1"
          }
        ]
      }
    ],
    "package": {
      "name": "tomcat10",
      "purl": "pkg:deb/debian/tomcat10?arch=source&distro=bookworm",
      "ecosystem": "Debian:12"
    },
    "versions": [
      "10.1.10-1",
      "10.1.13-1",
      "10.1.14-1",
      "10.1.15-1",
      "10.1.16-1",
      "10.1.20-1",
      "10.1.23-1",
      "10.1.25-1",
      "10.1.25-1~bpo12+1",
      "10.1.25-2",
      "10.1.30-1",
      "10.1.30-1~bpo12+1",
      "10.1.31-1",
      "10.1.33-1",
      "10.1.33-1~bpo12+1",
      "10.1.34-0+deb12u1",
      "10.1.34-0+deb12u2",
      "10.1.34-1",
      "10.1.35-1",
      "10.1.40-1",
      "10.1.40-1~bpo12+1",
      "10.1.46-1",
      "10.1.6-1",
      "10.1.6-1+deb12u1",
      "10.1.6-1+deb12u2",
      "10.1.7-1",
      "10.1.8-1",
      "10.1.9-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-55957.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "10.1.52-1~deb13u1"
          }
        ]
      }
    ],
    "package": {
      "name": "tomcat10",
      "purl": "pkg:deb/debian/tomcat10?arch=source&distro=trixie",
      "ecosystem": "Debian:13"
    },
    "versions": [
      "10.1.40-1",
      "10.1.46-1",
      "10.1.52-1~deb12u1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-55957.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "10.1.40-1"
          }
        ]
      }
    ],
    "package": {
      "name": "tomcat10",
      "purl": "pkg:deb/debian/tomcat10?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-55957.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "11.0.15-1~deb13u1"
          }
        ]
      }
    ],
    "package": {
      "name": "tomcat11",
      "purl": "pkg:deb/debian/tomcat11?arch=source&distro=trixie",
      "ecosystem": "Debian:13"
    },
    "versions": [
      "11.0.11-1",
      "11.0.6-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-55957.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "11.0.5-1"
          }
        ]
      }
    ],
    "package": {
      "name": "tomcat11",
      "purl": "pkg:deb/debian/tomcat11?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-55957.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "9.0.70-2"
          }
        ]
      }
    ],
    "package": {
      "name": "tomcat9",
      "purl": "pkg:deb/debian/tomcat9?arch=source&distro=bookworm",
      "ecosystem": "Debian:12"
    },
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-55957.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "9.0.70-2"
          }
        ]
      }
    ],
    "package": {
      "name": "tomcat9",
      "purl": "pkg:deb/debian/tomcat9?arch=source&distro=trixie",
      "ecosystem": "Debian:13"
    },
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-55957.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "9.0.70-2"
          }
        ]
      }
    ],
    "package": {
      "name": "tomcat9",
      "purl": "pkg:deb/debian/tomcat9?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-55957.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  }
]

Publisher severity

No explicit severity was provided.

Event: #57387 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 17:13:47 GMT
Publisher date: Mon, 29 Jun 2026 21:16:45 GMT

Read the original announcement