CVE-2026-43515: Apache Tomcat improper authorization in security constraints

CVE-2026-43515 · Severity: critical · CVSS 9.1 · Published 2026-05-12

Apache Tomcat is a widely used web server and application container for Java-based websites. A security flaw was discovered where the server fails to apply all intended access restrictions when multiple security rules are defined for the same file type. This could allow an unauthorized user to bypass security checks and access sensitive data or perform restricted actions on the server.

Technologies: Apache Tomcat, org.apache.tomcat:tomcat (Maven), org.apache.tomcat:tomcat-catalina (Maven), org.apache.tomcat.embed:tomcat-embed-core (Maven). Vendors: Apache, Maven.

Quick answers

Is CVE-2026-43515 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-43515 being exploited in the wild.
How severe is CVE-2026-43515?
Critical severity, with a CVSS score of 9.1, published 12 May 2026.
Which products and versions are affected?
Apache Tomcat 11.0.0-M1 to 11.0.21, 10.1.0-M1 to 10.1.54, 9.0.0.M1 to 9.0.117, 8.5.0 to 8.5.100, 7.0.0 to 7.0.109; org.apache.tomcat:tomcat (Maven) ECOSYSTEM:introduced=0,fixed=9.0.118; org.apache.tomcat:tomcat-catalina (Maven) ECOSYSTEM:introduced=0,fixed=9.0.118; org.apache.tomcat.embed:tomcat-embed-core (Maven) ECOSYSTEM:introduced=0,fixed=9.0.118.
Is there a fix for CVE-2026-43515?
Yes. org.apache.tomcat:tomcat (Maven): upgrade to 9.0.118 or later; org.apache.tomcat:tomcat-catalina (Maven): upgrade to 9.0.118 or later; org.apache.tomcat.embed:tomcat-embed-core (Maven): upgrade to 9.0.118 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-43515 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-43515?
Check whether you run Apache Tomcat, org.apache.tomcat:tomcat (Maven), org.apache.tomcat:tomcat-catalina (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.tomcat:tomcat (Maven): upgrade to 9.0.118 or later
    # set org.apache.tomcat:tomcat to 9.0.118 in your pom.xml or build.gradle
  • org.apache.tomcat:tomcat-catalina (Maven): upgrade to 9.0.118 or later
    # set org.apache.tomcat:tomcat-catalina to 9.0.118 in your pom.xml or build.gradle
  • org.apache.tomcat.embed:tomcat-embed-core (Maven): upgrade to 9.0.118 or later
    # set org.apache.tomcat.embed:tomcat-embed-core to 9.0.118 in your pom.xml or build.gradle

Technical details

An improper authorization vulnerability exists in Apache Tomcat's RealmBase component. When a configuration defines multiple security constraints for the same extension pattern (e.g., *.jsp) using different HTTP method constraints, the server only applies the first matching constraint and ignores subsequent ones. This allows remote, unauthenticated attackers to bypass intended access controls by using HTTP methods that should have been restricted by the ignored constraints. The issue is resolved in versions 11.0.22, 10.1.55, and 9.0.118.

Affected products

  • Apache Tomcat 11.0.0-M1 to 11.0.21, 10.1.0-M1 to 10.1.54, 9.0.0.M1 to 9.0.117, 8.5.0 to 8.5.100, 7.0.0 to 7.0.109

Identifiers

  • CVE-2026-43515
  • GHSA-5m62-pw8w-7w9f

Timeline

  • 2026-05-12: disclosed
  • 2026-05-12: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.