Apache Tomcat に複数の脆弱性

　独立行政法人情報処理推進機構（IPA）および一般社団法人JPCERT コーディネーションセンター（JPCERT/CC）は7月1日、Apache Tomcatにおける複数の脆弱性について「Japan Vulnerability Notes（JVN）」で発表した。

　The Apache Software Foundationでは6月29日に、Apache Tomcatの脆弱性（CVE-2026-55957、CVE-2026-55956、CVE-2026-55955、CVE-2026-55276、CVE-2026-53434、CVE-2026-53404、CVE-2026-50229）のアドバイザリを公開している。

　JVNでは、影響を受けるシステム、想定される影響、対策方法については、下記のApache Tomcatのアドバイザリを参照するよう案内している。

[SECURITY] CVE-2026-55957 Apache Tomcat - Authentication bypass with JNDIRealm and GSSAPI authenticated bind-Apache Mail Archives
https://lists.apache.org/thread/7fk339o5jvd4mcgsf0chbrn4o525ccjh

[SECURITY] CVE-2026-55956 Apache Tomcat - Security constraints for default servlet ignored method-Apache Mail Archives
https://lists.apache.org/thread/dcjdcnnnww9hhdm016hr0l7hpw1bzjfp

[SECURITY] CVE-2026-55955 Apache Tomcat - EncryptInterceptor not protected against replay attacks-Apache Mail Archives
https://lists.apache.org/thread/g4p5sf45p3f9r011pwqs9r54yd64s106

[SECURITY] CVE-2026-55276 Apache Tomcat - Logged effective web.xml is incomplete-Apache Mail Archives
https://lists.apache.org/thread/jy09xjlzn6r2qwvqoph8vcmf959yq68v

[SECURITY] CVE-2026-53434 Apache Tomcat - Invalid CRL configuration doesn't trigger failure for FFM Connector-Apache Mail Archives
https://lists.apache.org/thread/x510lbq0sfrd1qyo7q3r1mpllgpdcosk

[SECURITY] CVE-2026-53404 Apache Tomcat - Bad ornext processing in RewriteValve-Apache Mail Archives
https://lists.apache.org/thread/rdhpghgfskrdmw9hqzjgjrtw538smpmz

[SECURITY] CVE-2026-50229 Apache Tomcat - XXS in number guess example-Apache Mail Archives
https://lists.apache.org/thread/wlt2no8bw45zl1w8byop4zfqphldf5j0

Apache Tomcat - Apache Tomcat 11 vulnerabilities
https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.23

Apache Tomcat - Apache Tomcat 11 vulnerabilities
https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.5

Apache Tomcat - Apache Tomcat 10 vulnerabilities
https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.56

Apache Tomcat - Apache Tomcat 10 vulnerabilities
https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.39

Apache Tomcat - Apache Tomcat 9 vulnerabilities
https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.119

Apache Tomcat - Apache Tomcat 9 vulnerabilities
https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.102