Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Jun 17, 2026 · NIST NVD

   Updated

   Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix

2. Oct 15, 2026 · Apache Software Foundation

   Detected

   Named on the public Apache Software Foundation page.

Affected

• cpe apache/tomcatversion unspecified

Sources

• Apache Software FoundationVendor advisoryCVE-2026-43515

  Named on the public Apache Software Foundation page.

  tomcat.apache.org
• CVE.orgVulnerability recordCVE-2026-43515

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-43515

  Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 throug

  nvd.nist.gov

References

• Mailing List · openwall.com
• Mailing List · lists.apache.org