CVE-2026-43515: Apache Tomcat Improper Authorization Vulnerability
Summary
CVE-2026-43515: Apache Tomcat: Security constraints not correctly applied. Affects tomcat across 3 version ranges.
>= 9.0.0.M1, < 9.0.118
>= 10.1.0, < 10.1.55
>= 11.0.0, < 11.0.22
Fixed in 9.0.118, 10.1.55 or 11.0.22, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2026-43515 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source implementation of the Java Servlet, JavaServer Pages, and Java Expression Language technologies. It is widely used for deploying Java applications and provides a robust environment for running web applications. The package is known for its scalability, reliability, and extensive community support. However, certain versions of Tomcat are vulnerable to an improper authorization issue that can lead to unauthorized access under specific conditions.
Vulnerability Detail
The vulnerability arises from improper authorization when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This flaw can allow attackers to bypass security constraints, potentially leading to unauthorized access to sensitive resources. The affected versions include Apache Tomcat from 11.0.0 through 11.0.21, 10.1.0 through 10.1.54, 9.0.0.M1 through 9.0.117, 8.5.0 through 8.5.100, and 7.0.0 through 7.0.109. The ramifications of this vulnerability can be severe, as it may expose critical application data and functionalities to unauthorized users.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 9.0.0.M1, < 9.0.1189.0.118 -
>= 10.1.0, < 10.1.5510.1.55 -
>= 11.0.0, < 11.0.2211.0.22
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can review and adjust their security constraints to ensure that they are not relying on multiple method constraints for the same HTTP method and extension. This may involve modifying the web.xml configuration file to consolidate method constraints.
Conclusion
CVE-2026-43515 represents a significant security risk for users of Apache Tomcat versions 11.0.0 through 11.0.21, 10.1.0 through 10.1.54, 9.0.0.M1 through 9.0.117, 8.5.0 through 8.5.100, and 7.0.0 through 7.0.109. It is crucial for users to upgrade to the patched versions to mitigate the risk of unauthorized access.
See every vulnerability recorded for tomcat →
FAQ
CVE-2026-43515 is a vulnerability in Apache Tomcat that allows improper authorization due to multiple method constraints defining an HTTP method for the same extension.
The affected versions include Apache Tomcat from 11.0.0 through 11.0.21, 10.1.0 through 10.1.54, 9.0.0.M1 through 9.0.117, 8.5.0 through 8.5.100, and 7.0.0 through 7.0.109.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can use the Vulert playground at Vulert Scanner without any signup.
If immediate upgrading is not possible, consider implementing temporary workarounds by reviewing and adjusting your security constraints in the web.xml configuration file.
More information about CVE-2026-43515 can be found in the official Apache Tomcat security advisories and vulnerability databases.
Related vulnerabilities
Recent vulnerabilities recorded for tomcat.
