CVE-2026-43515
CRITICAL
Apache Tomcat - Security constraints not correctly applied
Published May 12, 2026Updated May 22, 2026Source: osv
Summary
Versions Affected:
Apache Tomcat 11.0.0-M1 to 11.0.21
Apache Tomcat 10.1.0-M1 to 10.1.54
Apache Tomcat 9.0.0.M1 to 9.0.117
Older, unsupported versions may also be affected
Description:
When multiple security constraints defined an HTTP method constraint for
the same extension pattern, only the first method constraint was applied.
Mitigation:
Users of the affected versions should apply one of the following
mitigations:
- Upgrade to Apache Tomcat 11.0.22 or later
- Upgrade to Apache Tomcat 10.1.55 or later
- Upgrade to Apache Tomcat 9.0.118 or later
Remediation
Upgrade to the fixed version using your package manager.
Maven
Update org.apache.tomcat.embed:tomcat-embed-core to 11.0.22 or later<!-- Update pom.xml dependency version to 11.0.22 for org.apache.tomcat.embed:tomcat-embed-core -->
Maven
Update org.apache.tomcat.embed:tomcat-embed-core to 9.0.118 or later<!-- Update pom.xml dependency version to 9.0.118 for org.apache.tomcat.embed:tomcat-embed-core -->
Maven
Update org.apache.tomcat.embed:tomcat-embed-core to 10.1.55 or later<!-- Update pom.xml dependency version to 10.1.55 for org.apache.tomcat.embed:tomcat-embed-core -->
Maven
Update org.apache.tomcat:tomcat-catalina to 9.0.118 or later<!-- Update pom.xml dependency version to 9.0.118 for org.apache.tomcat:tomcat-catalina -->
Maven
Update org.apache.tomcat:tomcat to 11.0.22 or later<!-- Update pom.xml dependency version to 11.0.22 for org.apache.tomcat:tomcat -->
Maven
Update org.apache.tomcat:tomcat-catalina to 11.0.22 or later<!-- Update pom.xml dependency version to 11.0.22 for org.apache.tomcat:tomcat-catalina -->
Maven
Update org.apache.tomcat:tomcat to 10.1.55 or later<!-- Update pom.xml dependency version to 10.1.55 for org.apache.tomcat:tomcat -->
Maven
Update org.apache.tomcat:tomcat to 9.0.118 or later<!-- Update pom.xml dependency version to 9.0.118 for org.apache.tomcat:tomcat -->
Maven
Update org.apache.tomcat:tomcat-catalina to 10.1.55 or later<!-- Update pom.xml dependency version to 10.1.55 for org.apache.tomcat:tomcat-catalina -->
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (9)
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| org.apache.tomcat.embed:tomcat-embed-core | maven | 11.0.0, 11.0.0-M1, 11.0.0-M10, 11.0.0-M11 (+38 more) | 11.0.22 |
| org.apache.tomcat.embed:tomcat-embed-core | maven | 7.0.0, 7.0.100, 7.0.103, 7.0.104 (+318 more) | 9.0.118 |
| org.apache.tomcat.embed:tomcat-embed-core | maven | 10.1.0, 10.1.0-M1, 10.1.0-M10, 10.1.0-M11 (+57 more) | 10.1.55 |
| org.apache.tomcat:tomcat-catalina | maven | 7.0.0, 7.0.100, 7.0.103, 7.0.104 (+318 more) | 9.0.118 |
| org.apache.tomcat:tomcat | maven | 11.0.0, 11.0.0-M1, 11.0.0-M10, 11.0.0-M11 (+38 more) | 11.0.22 |
| org.apache.tomcat:tomcat-catalina | maven | 11.0.0, 11.0.0-M1, 11.0.0-M10, 11.0.0-M11 (+38 more) | 11.0.22 |
| org.apache.tomcat:tomcat | maven | 10.1.0, 10.1.0-M1, 10.1.0-M10, 10.1.0-M11 (+57 more) | 10.1.55 |
| org.apache.tomcat:tomcat | maven | 7.0.100, 7.0.103, 7.0.104, 7.0.105 (+294 more) | 9.0.118 |
| org.apache.tomcat:tomcat-catalina | maven | 10.1.0, 10.1.0-M1, 10.1.0-M10, 10.1.0-M11 (+57 more) | 10.1.55 |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-285Improper AuthorizationMITRE
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 9.1 score means for each attack dimension.
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-43515ADVISORY
- https://github.com/apache/tomcat/commit/276087d9c7abbcecc6c4fb4e4b08cf64780c6e36WEB
- https://github.com/apache/tomcat/commit/c621317382682206fb58ab92ebd3e1b6fdd10ce9WEB
- https://github.com/apache/tomcat/commit/db919ff9912b4d61d1b702a1342b8bde39270031WEB
- https://github.com/apache/tomcatPACKAGE
- https://lists.apache.org/thread/746nxfxod0wsocxtmv8pb8nkgmwpc6bbWEB
- https://tomcat.apache.org/security-10.htmlWEB
- https://tomcat.apache.org/security-11.htmlWEB
- https://tomcat.apache.org/security-9.htmlWEB
- https://www.openwall.com/lists/oss-security/2026/05/12/11WEB
Frequently Asked Questions
- What is CVE-2026-43515?
- Apache Tomcat - Security constraints not correctly applied This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.1/10).
- How do I check if my project is affected by CVE-2026-43515?
- CVE-2026-43515 affects org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-catalina and org.apache.tomcat:tomcat. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-43515 and 200,000+ other known vulnerabilities.
Severity & Exploitability
CVSS Score
9.1
Exploitation is straightforward and causes maximum impact. Patch immediately.
Also Known As
GHSA-5m62-pw8w-7w9f
BIT-tomcat-2026-43515
Related CVEs
- CVE-2026-43512CRITICAL
Apache Tomcat - Digest authenticator will authenticate any unknown user
- CVE-2026-41293CRITICAL
Apache Tomcat - HTTP/2 request headers not validated
- CVE-2026-43513HIGH
Apache Tomcat: LockOutRealm treats user names as case-sensitive
- CVE-2026-42498HIGH
Apache Tomcat - WebSocket authentication header exposure
- CVE-2026-41284HIGH
Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling
- CVE-2026-34483HIGH
Apache Tomcat has an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve
- CVE-2025-49124MEDIUM
Apache Tomcat installer for Windows has an untrusted search path vulnerability
- CVE-2025-55754LOW
Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies