The vulnerability in Apache Tomcat involves an always-incorrect control flow implementation that results in special roles and empty authorization constraints not being included when the effective web.xml is logged. This affects Tomcat versions 11.0.0-M1 through 11.0.22, 10.1.0-M1 through 10.1.55, 9.0.0.M1 through 9.0.118, and 8.5.0 through 8.5.100. The problem is resolved by upgrading to versions 11.0.23, 10.1.56, or 9.0.119 and later. The vulnerability has a CVSS 3.1 vector indicating network attack vector, low complexity, no privileges or user interaction required, with high confidentiality and integrity impact but no availability impact. No known exploits in the wild have been reported. The affected Ubuntu Pro LTS versions include 14.04 through 26.04 and 25.10.

The vulnerability allows omission of special roles and empty authorization constraints in the effective web.xml logging, potentially leading to incorrect authorization behavior or security policy enforcement. The CVSS vector indicates a high impact on confidentiality and integrity if exploited remotely without privileges or user interaction. However, no known exploits in the wild have been reported.

A fix is available by upgrading Apache Tomcat to versions 11.0.23, 10.1.56, or 9.0.119 and later. Users should apply these updates to remediate the vulnerability. Since this is not a cloud service, remediation requires manual upgrade. No vendor advisory content contradicts this recommendation.