SB20260721102 - Ubuntu update for tomcat8
Published: July 21, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 vulnerabilities.
1) Improper access control (CVE-ID: CVE-2026-43515)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/U:Green
The vulnerability allows a remote attacker to bypass security constraints.
The vulnerability exists due to improper access control in HTTP method constraint processing when evaluating multiple security constraints for the same extension pattern. A remote attacker can send a request using an improperly constrained HTTP method to bypass security constraints.
2) Cross-site scripting (CVE-ID: CVE-2026-50229)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear
The vulnerability allows a remote attacker to execute cross-site scripting.
The vulnerability exists due to cross-site scripting in the number guess example when using wild card property mapping that exposes internal properties to clients. A remote attacker can supply crafted input that is reflected through exposed properties to execute cross-site scripting.
The issue is limited to the number guess example application.
3) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-53404)
CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to bypass rewrite conditions.
The vulnerability exists due to logic errors in RewriteValve when processing requests against OR-chained rewrite conditions. A remote attacker can send a request that matches the first OR condition to bypass rewrite conditions.
Exploitation requires a rule set that uses an OR chain followed by non-OR conditions.
4) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-55276)
CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation
CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a local user to obtain incomplete security configuration information.
The vulnerability exists due to logic errors in effective web.xml generation in the logged effective web.xml output when generating configuration logs. A local user can review the logged output to obtain incomplete security configuration information.
Special roles and empty authorization constraints are omitted from the logged effective web.xml.
Remediation
Install update from vendor's website.