Improper Authorization Vulnerability in Apache Tomcat Packages
Summary
DEBIAN-CVE-2026-43515: Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. Affects tomcat10 versions 10.1.10-1 – 10.1.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Tomcat is an open-source implementation of the Java Servlet, JavaServer Pages, and Java Expression Language technologies. It is widely used for deploying Java applications and provides a robust environment for running web applications. However, certain versions of Tomcat are susceptible to an improper authorization vulnerability that can lead to unauthorized access to resources.
Vulnerability Detail
The vulnerability arises from improper authorization when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This flaw can allow attackers to bypass security controls and access sensitive resources, potentially leading to data breaches or unauthorized actions. The affected versions include Apache Tomcat from 11.0.0-M1 through 11.0.21, 10.1.0-M1 through 10.1.54, 9.0.0.M1 through 9.0.117, 8.5.0 through 8.5.100, and 7.0.0 through 7.0.109.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can restrict access to sensitive resources through additional security configurations in their web applications. This may involve implementing stricter access controls or modifying the web.xml configuration files to limit method access.
Conclusion
The improper authorization vulnerability in Apache Tomcat poses significant risks to applications using affected versions. It is crucial for users to upgrade to the latest patched versions to mitigate these risks and ensure the security of their applications.
See every vulnerability recorded for tomcat10 →
FAQ
The vulnerability is an improper authorization issue that can allow unauthorized access to resources in Apache Tomcat.
Affected versions include Apache Tomcat from 11.0.0-M1 through 11.0.21, 10.1.0-M1 through 10.1.54, 9.0.0.M1 through 9.0.117, 8.5.0 through 8.5.100, and 7.0.0 through 7.0.109.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
Upgrade to the patched versions of Apache Tomcat (11.0.22, 10.1.55, or 9.0.118) and consider implementing additional access controls as a temporary measure.
Yes, Vulert allows you to monitor vulnerabilities using just a manifest file like package-lock.json, without requiring access to the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for tomcat10.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
