CVE-2026-43515: Tomcat Security Constraint Bypass Explained

CVE-2026-43515 is an Apache Tomcat authorization vulnerability caused by incorrect processing of security constraints when multiple HTTP method restrictions apply to the same extension-based URL pattern.

At first glance, the vulnerability looks unusually narrow. An application needs a particular style of Servlet security configuration, typically involving an extension mapping such as *.html, *.jsp, or another suffix pattern, together with multiple method-specific constraints. However, when that configuration exists, vulnerable versions of Tomcat may enforce one method constraint while silently failing to apply another.

That changes the security meaning of the application’s deployment descriptor.

A resource that administrators believe is protected by authentication and role-based authorization may therefore become reachable through an HTTP method that should have been restricted.

Apache disclosed CVE-2026-43515 on May 12, 2026 and describes the issue as an Improper Authorization vulnerability. Apache’s Tomcat security pages classify the vulnerability as Mäßig. Meanwhile, CISA-ADP assigned a CVSS 3.1 score of 9.1 Critical, using the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. NVD currently displays that externally supplied CISA-ADP score rather than its own NVD assessment. (Openwall)

The important point for defenders is therefore not simply the numeric severity.

CVE-2026-43515 should be prioritized according to whether a vulnerable Tomcat installation actually contains the security-constraint pattern required to trigger the flaw.

CVE-2026-43515 at a Glance

Artikel	Einzelheiten
CVE	CVE-2026-43515
Produkt	Apache Tomcat
Art der Schwachstelle	Improper Authorization / security constraint bypass
Primary component	Tomcat Realm security-constraint matching
Apache severity	Mäßig
CVSS 3.1 from CISA-ADP	9.1 Critical
Angriffsvektor	Netzwerk
Privileges required	None under exploitable configurations
User interaction	Keine
Primary condition	Multiple HTTP method constraints associated with the same extension URL pattern
Public disclosure	May 12, 2026
Tomcat 11 affected	11.0.0-M1 through 11.0.21
Tomcat 10 affected	10.1.0-M1 through 10.1.54
Tomcat 9 affected	9.0.0.M1 through 9.0.117
Tomcat 8.5 affected	8.5.0 through 8.5.100
Tomcat 7 affected	7.0.0 through 7.0.109
Supported fixed releases	11.0.22, 10.1.55, 9.0.118
CWE	CWE-285 Improper Authorization
Public PoC	Ja
KAG KEV	Not listed as of August 28, 2026

Apache states that CVE-2026-43515 occurs when multiple security constraints define HTTP method constraints for the same extension pattern and only the first method constraint is applied. The issue was reported to the Tomcat security team on April 20, 2026. (Apache Tomcat)

What Is CVE-2026-43515?

CVE-2026-43515 is fundamentally a mismatch between the access-control policy described by a Java web application’s Servlet configuration and the access-control policy actually enforced by vulnerable versions of Apache Tomcat.

Java web applications can define authorization rules inside WEB-INF/web.xml.

For example, administrators can say:

• requests to a particular resource require authentication;
• only users with a specific role may access that resource;
• GET requests should be allowed to one role;
• POST requests should require another role;
• some HTTP methods should be completely denied;
• or access restrictions should apply to every file matching a URL extension.

The Servlet specification models these rules using <security-constraint> und <web-resource-collection> elements.

A simplified example looks like this:

<security-constraint>
    <web-resource-collection>
        <web-resource-name>Protected HTML GET</web-resource-name>
        <url-pattern>*.html</url-pattern>
        <http-method>GET</http-method>
    </web-resource-collection>

    <web-resource-collection>
        <web-resource-name>Protected HTML POST</web-resource-name>
        <url-pattern>*.html</url-pattern>
        <http-method>POST</http-method>
    </web-resource-collection>

    <auth-constraint>
        <role-name>ADMIN</role-name>
    </auth-constraint>
</security-constraint>

Conceptually, the administrator is saying that both GET and POST operations against resources matching *.html should be protected by the constraint.

On affected Tomcat versions, however, the internal matching algorithm could find the extension match in the first resource collection and fail to correctly evaluate subsequent collections sharing that extension pattern.

The result could be:

GET /protected/secret.html
        ↓
*.html matches
        ↓
GET constraint found
        ↓
Authorization enforced

while another method followed a different path:

POST /protected/secret.html
        ↓
*.html matches first collection
        ↓
First collection covers GET, not POST
        ↓
Later *.html POST collection incorrectly ignored
        ↓
Expected constraint may not be returned
        ↓
Authorization protection can be bypassed

That is the heart of the Tomcat security constraint bypass.

Authentication Bypass or Authorization Bypass?

This distinction matters.

CVE-2026-43515 is more accurately described as an authorization bypass oder security constraint bypass, rather than a universal Tomcat authentication bypass.

Authentication answers:

Who is this user?

Authorization answers:

Is this user allowed to perform this operation on this resource?

The Tomcat bug occurs while determining which security constraints apply to a request. Therefore, the root problem is authorization enforcement.

However, the observable impact may look like an authentication bypass in a vulnerable application.

Suppose a normally protected POST endpoint requires an authenticated ADMIN user. If the method-specific security constraint is not selected at all, an unauthenticated request may reach application code.

From the attacker’s point of view, that looks like:

Unauthenticated request
        ↓
Protected endpoint
        ↓
Expected authentication challenge missing
        ↓
Request succeeds

But the underlying defect is that Tomcat failed to select the authorization constraint that should have triggered the authentication and role checks.

Red Hat similarly describes the vulnerability as allowing a remote attacker to bypass intended security restrictions for information or actions within an application. (Red Hat Customer Portal)

How Tomcat Security Constraints Are Supposed to Work

Understanding CVE-2026-43515 requires understanding Servlet security constraints.

The Jakarta Servlet specification defines a security constraint as a combination of:

Web Resource Collection
        +
Authorization Constraint
        +
Optional User Data Constraint

The web resource collection determines which HTTP requests are covered.

It may include:

<url-pattern>/admin/*</url-pattern>

or:

<url-pattern>*.html</url-pattern>

It can also restrict the policy to specific methods:

<http-method>GET</http-method>

or exclude certain methods:

<http-method-omission>GET</http-method-omission>

The authorization section then determines who can access those resources.

Zum Beispiel:

<auth-constraint>
    <role-name>ADMIN</role-name>
</auth-constraint>

The Jakarta Servlet 6.1 specification explicitly explains that a web resource collection consists of URL patterns plus HTTP methods or method omissions, and that authorization constraints determine which roles can perform the constrained requests. (jakarta.ee)

The important concept is that Tomcat must combine the URL and method dimensions correctly.

A request is not simply:

/protected/data.html

It is effectively:

GET + /protected/data.html

or:

POST + /protected/data.html

or:

DELETE + /protected/data.html

Two requests for the same URI can therefore have entirely different authorization requirements.

URL Pattern Matching Makes the Vulnerability More Subtle

Servlet containers support several forms of URL mapping.

Typical patterns include:

/admin/report

for an exact match,

/admin/*

for a path-prefix match,

and:

*.html

for an extension match.

The Tomcat fix specifically refers to ensuring that RealmBase finds all matching extension-based constraints. The upstream patch therefore tells us precisely where the bug existed: the problem occurred while processing suffix-style patterns such as *.html. (GitHub)

That is important because a security team performing a simple search for:

<security-constraint>

will produce too many false positives.

The higher-value audit target is:

extension pattern
+
multiple resource collections
+
method-specific restrictions

Zum Beispiel:

<url-pattern>*.html</url-pattern>
<http-method>GET</http-method>

appearing alongside another collection such as:

<url-pattern>*.html</url-pattern>
<http-method>POST</http-method>

is much more interesting than a generic constraint covering /admin/* without method differentiation.

Root Cause Inside RealmBase.findSecurityConstraints()

Apache’s patch provides a particularly clear explanation of the implementation bug.

The relevant code lives in:

org.apache.catalina.realm.RealmBase

and specifically:

findSecurityConstraints(Request request, Context context)

The fixed Tomcat 11 commit is 276087d9, while corresponding patches were applied to other maintained branches, including c6213173 for Tomcat 10.1 and db919ff9 for Tomcat 9. (Apache Tomcat)

Before the fix, the extension-matching portion of the algorithm effectively maintained state resembling:

boolean matched = false;
int pos = -1;

outside the loop over security collections.

When an extension pattern matched, Tomcat recorded which collection matched.

It then later used something conceptually equivalent to:

collection[pos].findMethod(method)

to determine whether the HTTP method was covered.

The flaw was that several resource collections could match the same extension.

Consider:

Collection 0
Pattern: *.html
Method: GET

Collection 1
Pattern: *.html
Method: POST

For:

POST /protected/secret.html

both collections match at the URL-pattern level.

But only the second collection matches at the HTTP-method level.

The vulnerable algorithm could stop with or otherwise retain the first extension match and test POST against the GET collection.

That produced:

*.html → yes
POST in GET collection → no

instead of continuing to ask:

Does another *.html collection contain POST?

The patch changes the logic so that matching is evaluated per collection.

The critical behavior becomes conceptually:

for each SecurityCollection:
    matched = false

    for each pattern:
        if extension matches:
            matched = true

    if matched:
        found = true

        if thisCollection.findMethod(requestMethod):
            add constraint

This seemingly small placement change is security-significant.

The official Tomcat commit describes the fix as:

“Ensure RealmBase finds all matching extension based constraints”

and the patch moves matched into the loop that evaluates each collection, allowing every relevant collection to participate in method matching. (GitHub)

Apache Added a Regression Test That Shows the Exact Failure Pattern

The Apache patch also added a regression test.

That test creates one security constraint and adds two collections.

The first contains:

getCollection.addMethod(Method.GET);
getCollection.addPatternDecoded("*.html");

and the second contains:

postCollection.addMethod(Method.POST);
postCollection.addPatternDecoded("*.html");

Apache then verifies authorization independently for both GET and POST requests.

This is valuable evidence because it narrows the vulnerability condition considerably: the bug is specifically about more than one matching extension-based resource collection being relevant to method-based authorization. (GitHub)

In other words, CVE-2026-43515 is not a generic failure of every <security-constraint>.

It is a failure of constraint resolution under a particular overlapping-pattern condition.

A Simplified Vulnerable Configuration

A representative deployment descriptor might look like:

<security-constraint>

    <web-resource-collection>
        <web-resource-name>Admin GET</web-resource-name>
        <url-pattern>*.html</url-pattern>
        <http-method>GET</http-method>
    </web-resource-collection>

    <web-resource-collection>
        <web-resource-name>Admin POST</web-resource-name>
        <url-pattern>*.html</url-pattern>
        <http-method>POST</http-method>
    </web-resource-collection>

    <auth-constraint>
        <role-name>ADMIN</role-name>
    </auth-constraint>

</security-constraint>

An administrator reading the configuration naturally expects:

GET *.html  → ADMIN
POST *.html → ADMIN

A patched container should enforce both.

The vulnerable behavior can instead resemble:

Anfrage	Intended	Vulnerable behavior
GET /secret.html	Require ADMIN	Protected
POST /secret.html	Require ADMIN	Constraint may be omitted
GET /public.txt	Not covered	Normal application behavior
POST /public.txt	Not covered	Normal application behavior

The exact HTTP response still depends on the application.

A bypass does not guarantee that every POST request returns sensitive information. Application code, Spring Security, reverse proxies, custom filters, or other controls may independently reject the request.

But relying on those additional layers does not make the Tomcat bug harmless.

The deployment descriptor’s security guarantee has already failed.

Why HTTP Method Switching Can Become Dangerous

Many web applications assign dramatically different semantics to HTTP methods.

Zum Beispiel:

GET /account/profile.html

might only display information.

But:

POST /account/profile.html

might update account information.

Likewise:

GET /admin/user.html

could show a form,

while:

POST /admin/user.html

could create or modify a privileged account.

A method-specific authorization bypass is therefore potentially more serious than a read-only access-control failure.

An affected application could theoretically expose operations involving:

account modification
administrative changes
workflow approval
record deletion
file operations
credential changes
configuration changes
business transactions

The actual impact must be evaluated at the application layer.

This is one reason CISA-ADP’s CVSS vector assigns both confidentiality and integrity impacts as High while leaving availability at None. (NVD)

Affected Apache Tomcat Versions

Apache lists the following versions as affected:

Zweigstelle	Affected
Apache Tomcat 11	11.0.0-M1 through 11.0.21
Apache Tomcat 10.1	10.1.0-M1 through 10.1.54
Apache Tomcat 9	9.0.0.M1 through 9.0.117
Apache Tomcat 8.5	8.5.0 through 8.5.100
Apache Tomcat 7	7.0.0 through 7.0.109
Earlier than Tomcat 7	Impact listed as unknown

Apache recommends upgrading maintained deployments to:

Tomcat 11.0.22 or later
Tomcat 10.1.55 or later
Tomcat 9.0.118 or later

These version ranges are consistent across the Apache advisory, NVD, GitHub Advisory Database, and oss-security disclosure. (Openwall)

Tomcat 7 and Tomcat 8.5 deserve additional attention.

These branches are already unsupported. Organizations should not interpret their absence from the recommended current-version list as meaning they are safe.

Apache explicitly identifies Tomcat 7.0.0–7.0.109 and 8.5.0–8.5.100 as affected. The appropriate long-term remediation is migration to a supported Tomcat branch rather than continuing to depend on end-of-life software. (Openwall)

Tomcat 11

CVE-2026-43515 affects:

11.0.0-M1
through
11.0.21

Tomcat 11.0.22 contains the fix.

The Tomcat 11 security page records the issue under the release dated May 5, 2026 and links it to commits 276087d9 und 06597486. (Apache Tomcat)

Tomcat 10.1

CVE-2026-43515 affects:

10.1.0-M1
through
10.1.54

The supported fixed release is:

10.1.55

Apache identifies commit:

c6213173

as the primary fix for this branch. (Apache Tomcat)

Tomcat 9

Affected versions are:

9.0.0.M1
through
9.0.117

The vulnerability is fixed in:

9.0.118

with the corresponding branch fix:

db919ff9

(Apache Tomcat)

CVE-2026-43515 Severity: Moderate or Critical?

One of the most confusing aspects of this CVE is severity.

Apache calls it:

Mäßig

while GitHub Advisory Database displays:

9.1 Critical

Both can be true within their respective scoring frameworks.

Apache’s rating reflects the fact that exploitation requires a relatively specific application configuration.

The vulnerability does not mean:

Internet
   ↓
Any Tomcat server
   ↓
Authentication instantly bypassed

Instead, the path is closer to:

Affected Tomcat
        +
extension-based URL security constraints
        +
multiple relevant method constraints
        +
valuable application functionality behind them
        ↓
security impact

That configuration dependency lowers broad population-level exploitability.

CVSS, however, focuses heavily on the characteristics of an attack once the vulnerable condition exists.

CISA-ADP records:

AV:N
AC:L
PR:N
UI:N
S:U
C:H
I:H
A:N

which produces 9.1.

That means:

Network attack vector: exploitation can occur remotely through HTTP.

Low attack complexity: once the required configuration exists, exploitation does not necessarily require complex race conditions or advanced primitives.

No privileges required: an unauthenticated remote user may trigger the affected path.

No user interaction: no victim needs to click a link or open a document.

High confidentiality impact: protected information could potentially become accessible.

High integrity impact: protected actions could potentially become executable.

No direct availability impact: denial of service is not the central vulnerability.

NVD had not published its own separate CVSS assessment in the retrieved record and displays the 9.1 CISA-ADP score. (NVD)

Therefore, defenders should avoid arguing over whether the vulnerability is “Moderate” or “Critical.”

Ask a more useful question:

Does our application contain the vulnerable security-constraint structure, and what business operations are behind those constraints?

Is CVE-2026-43515 Being Exploited?

As of August 28, 2026, public proof-of-concept material exists for CVE-2026-43515.

A publicly indexed PoC environment demonstrates the issue using an affected Tomcat instance, an extension-based web.xml constraint configuration, and different HTTP methods to compare protected versus unexpectedly accessible behavior. (PoC Archive)

However, public PoC availability is not equivalent to confirmed widespread exploitation.

CISA’s SSVC data recorded by NVD marked exploitation as:

keine

while also describing the vulnerability as automatable with potentially total technical impact under the assessed scenario. (NVD)

Rapid7 also reports that CVE-2026-43515 is not currently in the CISA Known Exploited Vulnerabilities catalog.

That distinction matters.

The current situation is better summarized as:

Public vulnerability details: Yes
Patch diff: Yes
Public PoC: Yes
Network reachable attack surface: Potentially
Confirmed CISA KEV exploitation: No
Reason to delay patching: No

A public patch plus a small and understandable access-control bug makes reproduction considerably easier than it was at initial disclosure.

How an Attacker Would Think About CVE-2026-43515

From a security-testing perspective, identifying an affected Tomcat version is only step one.

A version banner such as:

Apache Tomcat/10.1.52

does not prove exploitability.

The attacker still needs an application whose security policy exposes the vulnerable constraint arrangement.

The logical reconnaissance sequence is therefore:

Identify Tomcat
        ↓
Estimate version
        ↓
Identify protected extension-based resources
        ↓
Compare behavior across HTTP methods
        ↓
Look for inconsistent authentication challenges
        ↓
Determine whether application functionality becomes reachable

The highest-value signal is authorization asymmetry between methods.

Imagine:

GET /private/report.html

returns:

HTTP/1.1 401 Unauthorized

while:

POST /private/report.html

unexpectedly reaches the application.

That is far more interesting than the version number alone.

Safe Validation of CVE-2026-43515

Testing should only be performed against systems you own or are explicitly authorized to assess.

A defensive validation strategy does not need destructive payloads.

Start with a known protected resource and compare authentication behavior across methods.

Zum Beispiel:

curl -i http://127.0.0.1:8080/app/protected/test.html

Then:

curl -i -X POST \
  http://127.0.0.1:8080/app/protected/test.html

You are looking for differences such as:

GET  → 401
POST → 200

or:

GET  → 403
POST → application response

The most convincing result is not simply a status-code difference.

Different HTTP methods often legitimately return different codes.

Instead, correlate the response with the expected authorization policy.

A valid test asks:

Was POST supposed to require the same security role?

If yes, yet Tomcat processes it without the expected authentication or role check, investigation is warranted.

A safe lab should preferably use a non-sensitive endpoint whose handler only returns something like:

METHOD_REACHED

rather than testing against production operations.

Why Generic Vulnerability Scanning May Miss the Issue

CVE-2026-43515 is difficult to detect reliably with a pure version scanner.

Version scanning can tell you:

Tomcat 10.1.52
→ potentially affected

but cannot necessarily determine:

Does web.xml use overlapping extension constraints?

Conversely, black-box HTTP testing may identify inconsistent method behavior but not know whether the cause is CVE-2026-43515, custom application authorization, proxy routing, Spring Security, or another middleware component.

High-confidence detection therefore benefits from combining:

software inventory
+
deployment descriptor analysis
+
HTTP behavior

This is a good example of why vulnerability management should distinguish between:

vulnerable software

and:

exploitable application configuration.

How to Audit web.xml for CVE-2026-43515

Search deployed applications for:

WEB-INF/web.xml

and inspect <security-constraint> definitions.

Start by identifying extension patterns:

<url-pattern>*.html</url-pattern>

<url-pattern>*.jsp</url-pattern>

<url-pattern>*.do</url-pattern>

or custom suffixes.

Then look for method-specific rules:

<http-method>GET</http-method>

<http-method>POST</http-method>

<http-method>PUT</http-method>

<http-method>DELETE</http-method>

A configuration becomes particularly relevant when the same suffix appears in several web resource collections associated with different methods.

Zum Beispiel:

<web-resource-collection>
    <url-pattern>*.do</url-pattern>
    <http-method>GET</http-method>
</web-resource-collection>

<web-resource-collection>
    <url-pattern>*.do</url-pattern>
    <http-method>POST</http-method>
</web-resource-collection>

That does not automatically prove exploitation.

But on an affected Tomcat release, it is exactly the type of configuration that deserves immediate testing and remediation.

Static Detection Script

Defenders can perform a basic configuration audit with a simple local script.

The following example looks for repeated extension patterns associated with method-specific resource collections:

from pathlib import Path
import xml.etree.ElementTree as ET
from collections import defaultdict

web_xml = Path("WEB-INF/web.xml")

tree = ET.parse(web_xml)
root = tree.getroot()

patterns = defaultdict(list)

for elem in root.iter():
    if not elem.tag.endswith("web-resource-collection"):
        continue

    url_patterns = []
    methods = []

    for child in elem:
        tag = child.tag.split("}")[-1]

        if tag == "url-pattern" and child.text:
            url_patterns.append(child.text.strip())

        if tag == "http-method" and child.text:
            methods.append(child.text.strip())

    for pattern in url_patterns:
        if pattern.startswith("*."):
            patterns[pattern].append(methods)

for pattern, method_sets in patterns.items():
    if len(method_sets) > 1:
        print(f"[REVIEW] repeated extension pattern: {pattern}")
        for methods in method_sets:
            print("  methods:", methods or ["ALL"])

This is not a complete vulnerability scanner.

It is a triage mechanism.

Namespace handling, annotation-based security, generated descriptors, framework-level controls, multiple applications, and container-level configuration can complicate analysis.

But it can quickly identify applications that deserve deeper review.

Check Embedded Tomcat Too

Traditional Tomcat deployments are only one part of the exposure.

Applications may bundle Tomcat libraries through Maven dependencies.

GitHub Advisory Database identifies affected Maven packages including:

org.apache.tomcat.embed:tomcat-embed-core
org.apache.tomcat:tomcat
org.apache.tomcat:tomcat-catalina

with fixed versions corresponding to Tomcat 9.0.118, 10.1.55, and 11.0.22. (GitHub)

This is especially relevant to Spring Boot environments.

Security teams should therefore avoid checking only:

/usr/local/tomcat/

or standalone server inventories.

Also inspect:

pom.xml
pom.lock-style dependency reports
Gradle dependencies
SBOMs
container images
fat JAR contents
transitive dependencies

For Maven-based projects, dependency inventory may reveal:

<dependency>
    <groupId>org.apache.tomcat.embed</groupId>
    <artifactId>tomcat-embed-core</artifactId>
</dependency>

The effective version matters more than whether developers explicitly remember installing Tomcat.

Detecting Suspicious Behavior in HTTP Logs

CVE-2026-43515 does not have a unique network signature.

There is no special exploit string comparable to an SQL injection payload.

The attacker may simply change the HTTP method.

Zum Beispiel:

GET /secure/report.html
POST /secure/report.html
PUT /secure/report.html

The most useful behavioral signal is therefore inconsistent authorization results.

A possible sequence might look like:

203.0.113.25 - - [28/Aug/2026:10:31:05] "GET /admin/report.html HTTP/1.1" 401
203.0.113.25 - - [28/Aug/2026:10:31:07] "HEAD /admin/report.html HTTP/1.1" 401
203.0.113.25 - - [28/Aug/2026:10:31:09] "POST /admin/report.html HTTP/1.1" 200

A single POST request returning 200 is not evidence of exploitation.

But the combination of:

same source
+
same URI
+
rapid method switching
+
authentication failures followed by success

is useful hunting data.

Example Detection Logic

A SIEM hunting strategy could conceptually group requests by:

source IP
URI
short time window

and alert when:

method A → 401/403
method B → 2xx

against known protected extension-based resources.

Pseudocode:

WHERE uri matches "*.html" OR "*.jsp" OR known protected extension
GROUP BY src_ip, uri
WINDOW 5 minutes

IF
    failed_auth_methods >= 1
AND
    successful_other_methods >= 1
THEN
    investigate

This should not be deployed as a high-confidence standalone alert because legitimate REST behavior can produce similar patterns.

It works better when correlated with known CVE-2026-43515 exposure.

Warum <deny-uncovered-http-methods> Still Matters

The Jakarta Servlet specification explicitly warns developers about uncovered HTTP methods.

When security constraints enumerate only specific HTTP methods, methods outside those enumerations may remain uncovered.

The specification recommends, where appropriate, using:

<deny-uncovered-http-methods/>

and ensuring that every allowed HTTP method is intentionally covered. (jakarta.ee)

This is not a substitute for patching CVE-2026-43515.

The vulnerability occurs because Tomcat incorrectly evaluates constraints that administrators did define.

Nevertheless, reducing method ambiguity is good defense-in-depth.

A secure design should avoid depending on assumptions such as:

Nobody will use PUT here anyway.

If PUT should not be permitted, deny it.

If DELETE should not be permitted, deny it.

If only GET and POST are valid, define that security posture explicitly.

Sanierung

The preferred mitigation is straightforward:

Upgrade Tomcat.

For maintained branches:

Tomcat 11 → 11.0.22 or later
Tomcat 10.1 → 10.1.55 or later
Tomcat 9 → 9.0.118 or later

Apache explicitly recommends these versions in its advisory. (Openwall)

Do not stop at exactly those patch versions if a newer maintained security release is available.

Zum Beispiel:

10.1.55

should be interpreted as:

10.1.55 or newer supported 10.1.x release

not as a reason to downgrade a system already running a later patched release.

What About Tomcat 7 and 8.5?

Migrate.

Tomcat 7 and Tomcat 8.5 are end-of-life branches, and Apache still identifies them as affected by CVE-2026-43515. (Openwall)

Continuing to run obsolete branches turns vulnerability remediation into an endless backporting problem.

The safer migration direction is:

Tomcat 7 / 8.5
        ↓
supported application compatibility assessment
        ↓
supported Tomcat branch
        ↓
current security release

Legacy application compatibility may make this difficult, particularly around Servlet API changes, javax.* versus jakarta.*, older frameworks, and Java runtime requirements.

That operational difficulty does not reduce the security risk of keeping an unsupported container in production.

Temporary Configuration Mitigation

If an emergency upgrade cannot immediately be completed, review overlapping extension-based method constraints and simplify the configuration.

For example, rather than relying on multiple resource collections sharing:

<url-pattern>*.html</url-pattern>

consider whether the security model can protect the entire extension without method-specific differentiation:

<security-constraint>
    <web-resource-collection>
        <web-resource-name>Protected HTML</web-resource-name>
        <url-pattern>*.html</url-pattern>
    </web-resource-collection>

    <auth-constraint>
        <role-name>ADMIN</role-name>
    </auth-constraint>
</security-constraint>

Now the authorization policy applies to all methods covered by that URL pattern.

Whether this is suitable depends on the application.

Do not blindly modify production web.xml files without understanding how legitimate operations depend on method-specific policies.

And configuration changes should be treated as temporary risk reduction, not as a replacement for installing the upstream fix.

Reverse Proxy Mitigation

Organizations that know exactly which methods are required for a protected application may also enforce HTTP methods at an upstream proxy.

Conceptually:

Internet
   ↓
Reverse Proxy
   ↓
Allowed methods only
   ↓
Tomcat

For a read-only endpoint:

Allow: GET, HEAD
Deny: POST, PUT, PATCH, DELETE

can reduce exposure.

Again, this is defense-in-depth.

The proxy does not fix Tomcat’s incorrect constraint-selection logic.

It merely prevents some requests from reaching it.

Application-Level Authorization Is Important

Servlet container security should not necessarily be the application’s only authorization layer.

Sensitive operations benefit from application-level authorization checks as well.

Zum Beispiel:

if (!currentUser.hasRole("ADMIN")) {
    throw new AccessDeniedException();
}

or framework equivalents.

In a layered architecture:

Reverse proxy policy
        ↓
Tomcat security constraint
        ↓
Framework authorization
        ↓
Business-logic authorization

one failed control does not automatically expose the business operation.

CVE-2026-43515 demonstrates why this matters.

A deployment descriptor may look correct while the container processes it incorrectly.

Do WAFs Stop CVE-2026-43515?

Usually not reliably.

There is no inherently malicious payload.

An exploit request may look syntactically normal:

POST /protected/account.html HTTP/1.1
Host: example.com
Content-Length: 0

Nothing about that request screams exploitation.

The security failure exists in the server’s interpretation of its authorization configuration.

A WAF can help if it knows that POST should never reach the endpoint.

But generic attack signatures are unlikely to provide dependable protection.

This makes configuration-aware detection more valuable than payload-based signatures.

Why CVE-2026-43515 Matters for Pentesters

The vulnerability is a useful reminder that access-control testing must be method-aware.

A common test pattern is:

request protected page
→ get 401
→ mark protected
→ move on

That is insufficient.

For security-sensitive routes, testers should consider:

GET
HEAD
POST
PUT
PATCH
DELETE
OPTIONS

according to application semantics and authorization scope.

The interesting question is not:

Can I access this URL?

It is:

Can I perform any operation on this resource that the authorization policy should prohibit?

CVE-2026-43515 is almost a textbook example of that distinction.

Why Black-Box Testing Alone Can Produce False Positives

Imagine:

GET /admin/task.html → 401
POST /admin/task.html → 200

That looks suspicious.

But perhaps POST is intentionally public.

Maybe the endpoint implements a webhook.

Maybe a framework filter handles GET and POST differently.

Maybe authentication is performed inside application code and the 200 response contains only:

{"error":"authentication_required"}

rather than sensitive content.

Therefore, status code alone is not enough.

A strong validation chain contains:

1. Vulnerable Tomcat version
2. Relevant extension-based security constraint
3. Multiple method-specific collections
4. Expected authorization requirement
5. Request demonstrating enforcement difference
6. Evidence that unauthorized functionality or information is actually reachable

That produces a far more defensible finding.

Why Static Analysis Alone Can Also Produce False Positives

The opposite problem exists.

An analyst might find:

*.html + GET
*.html + POST

innerhalb web.xml.

But the deployed Tomcat may already be patched.

Or an application may never expose URLs matching the constraint.

Or an upstream gateway may block the relevant method.

Or additional application-layer authorization may eliminate practical impact.

This is why security assessment should combine static configuration analysis with runtime verification.

Suggested Exposure Classification

A practical vulnerability-management model is:

Level	Zustand
Potential	Vulnerable Tomcat version
Configuration-relevant	Vulnerable version plus overlapping extension/method constraints
Reachable	Relevant protected resource reachable over network
Behavior confirmed	HTTP method demonstrates constraint inconsistency
Exploitable	Unauthorized information or functionality is actually accessible

This is far more useful than treating every Tomcat installation below the patched version as equally dangerous.

CVE-2026-43515 vs CVE-2026-55956

CVE-2026-43515 is not the only Tomcat security-constraint issue disclosed in 2026.

Apache later disclosed CVE-2026-55956, another Moderate vulnerability involving security constraints.

However, the root conditions are different.

For CVE-2026-55956, Apache states that when security constraints were specified for the default servlet, configured HTTP methods or method omissions could be ignored. The issue affected Tomcat 10.1 through 10.1.55 before being fixed in 10.1.56, with corresponding impacts on other branches. (Apache Tomcat)

The distinction can be summarized as:

CVE	Kernthema
CVE-2026-43515	Multiple method constraints sharing the same extension pattern
CVE-2026-55956	Method handling for constraints associated with the default servlet

They should not be merged into one generic “Tomcat authentication bypass” finding.

CVE-2026-43515 vs CVE-2026-24733

CVE-2026-24733 was another Tomcat security constraint bypass.

Its cause was different again.

Apache states that Tomcat did not limit HTTP/0.9 requests to GET. Under a configuration where HEAD was allowed but GET was denied, a specially structured HTTP/0.9 request could bypass the intended constraint. (Apache Tomcat)

This comparison shows a broader pattern worth understanding:

Authorization policy
        ↓
HTTP parsing / method interpretation
        ↓
URL mapping
        ↓
constraint selection
        ↓
enforcement

A flaw anywhere in this chain can create a security-control bypass even when the web.xml configuration itself looks reasonable.

CVE-2026-43515 vs CVE-2025-66614

CVE-2025-66614 involved Tomcat client-certificate authentication rather than HTTP method constraint resolution.

In that vulnerability, differing SNI and HTTP Host values could matter when virtual hosts had different TLS client-certificate requirements and authentication was enforced only at the Connector. Apache explicitly notes that the flaw did not apply when client-certificate authentication was enforced at the web-application level. (Apache Tomcat)

Again, the theme is layered security enforcement.

CVE-2025-66614 affected the relationship between:

TLS virtual host selection
and
HTTP virtual host selection

while CVE-2026-43515 affects:

URL extension selection
and
HTTP method authorization

Both demonstrate why container-level authentication and authorization logic deserves the same attention as application vulnerabilities.

Patch Diff Analysis Is Particularly Valuable Here

CVE advisories frequently provide only a one-paragraph description.

CVE-2026-43515 is a good case where the upstream patch dramatically improves understanding.

The disclosure says:

only the first method constraint was applied.

The code diff reveals why.

The regression test reveals the minimal arrangement needed to reproduce it.

This gives defenders three independent forms of evidence:

Vendor advisory
        ↓
Source patch
        ↓
Regression test

For vulnerability research, that is substantially stronger than relying on secondary CVE summaries.

Security Teams Should Search for the Configuration, Not Just the CVE

A high-value enterprise hunt can be structured around three questions.

First:

Which systems run affected Tomcat versions?

Second:

Which deployed applications use extension-based security constraints?

Third:

Which of those applications divide authorization by HTTP method?

Intersect the three sets:

Affected version
∩
extension mapping
∩
multiple method rules
=
highest-priority assets

That can reduce hundreds of potential vulnerable components to a much smaller number of genuinely important applications.

SBOM and Dependency Scanning

For embedded Tomcat, dependency scanners should flag affected versions of relevant artifacts.

Zum Beispiel:

org.apache.tomcat.embed:tomcat-embed-core

A useful remediation workflow is:

SBOM
   ↓
identify Tomcat component
   ↓
map to CVE-2026-43515
   ↓
verify effective runtime version
   ↓
inspect security configuration
   ↓
upgrade
   ↓
runtime validation

Dependency scanning solves the inventory problem.

It does not completely solve the exploitability problem.

Container Image Hunting

Tomcat often appears in Docker and Kubernetes environments.

Search image inventories for:

tomcat:9
tomcat:10
tomcat:11

but do not stop with official Tomcat image names.

Application images may contain Tomcat dependencies without exposing the word Tomcat in their image tag.

Useful sources include:

SBOM package inventory
Maven dependencies
JAR manifests
application startup logs
container filesystem
Java process command line

Kubernetes security teams should map vulnerable application images back to:

Deployment
StatefulSet
Namespace
Ingress
external exposure
service account
business owner

so patch priority reflects reachable risk.

Post-Patch Verification

After upgrading, repeat the authorization tests.

Do not assume package installation alone proves successful remediation.

Überprüfen:

curl -i \
  http://127.0.0.1:8080/app/protected/test.html

and:

curl -i \
  -X POST \
  http://127.0.0.1:8080/app/protected/test.html

Both methods should now behave according to the intended security policy.

Also confirm the runtime version actually changed.

Containers, immutable images, stale pods, blue-green deployments, and embedded application dependencies can leave old instances running even after engineers believe a patch has been deployed.

Recommended Incident-Hunting Questions

If an affected application was internet-facing before remediation, defenders should review historical telemetry.

Useful questions include:

Were protected extension-based URLs accessed through unusual HTTP methods?

Did a source receive 401 or 403 for one method and later succeed using another?

Were administrative actions executed without an associated authenticated session?

Did method-switching activity originate from scanning infrastructure?

Were affected endpoints reachable before the patch date?

Did any reverse proxy normalize or rewrite methods before Tomcat?

The absence of a CISA KEV listing does not prove that no exploitation occurred against a particular organization.

It only means confirmed exploitation has not triggered that catalog status.

Hardening Checklist

Organizations operating Apache Tomcat should adopt several controls beyond the immediate CVE patch.

Keep Tomcat on a supported branch. Running Tomcat 7 or 8.5 dramatically increases long-term exposure.

Minimize method-specific container authorization where possible. Simpler security policies are easier to reason about and test.

Explicitly deny unwanted HTTP methods. Do not rely on an application simply “not using” PUT, PATCH, or DELETE.

Verwenden Sie <deny-uncovered-http-methods> where appropriate. The Servlet specification specifically provides this mechanism to reduce accidental method exposure. (jakarta.ee)

Enforce sensitive authorization inside the application as well. Container controls should not necessarily be the final authorization decision for high-risk operations.

Test authorization matrices automatically. Every important route should have tests covering roles, authentication states, and HTTP methods.

Monitor method anomalies. Method switching against a protected URI is useful reconnaissance telemetry.

Inventory embedded Tomcat dependencies. Standalone servers are only part of the problem.

Example Authorization Test Matrix

Instead of testing only URLs, security teams can model access like this:

Endpoint	Method	Anonymous	USER	ADMIN
/admin/report.html	GET	Deny	Deny	Allow
/admin/report.html	POST	Deny	Deny	Allow
/admin/report.html	PUT	Deny	Deny	Deny
/profile/account.html	GET	Deny	Allow	Allow
/profile/account.html	POST	Deny	Allow	Allow

Automated testing can then verify every cell.

For CVE-2026-43515, the critical failure would look like:

Endpoint	Method	Erwartet	Actual
/admin/report.html	GET	401	401
/admin/report.html	POST	401	200

This is a much stronger detection method than checking whether a login page exists.

Frequently Asked Questions

What is CVE-2026-43515?

CVE-2026-43515 is an Apache Tomcat Improper Authorization vulnerability in which multiple HTTP method security constraints associated with the same extension-based URL pattern may not all be correctly applied.

Is CVE-2026-43515 an authentication bypass?

It is technically an authorization/security-constraint bypass. In some configurations the result can allow an unauthenticated request to reach a resource that should have triggered authentication, so the practical effect may resemble an authentication bypass.

Is every vulnerable Tomcat server exploitable?

No.

The relevant security-constraint configuration needs to exist. A vulnerable version alone establishes potential exposure, not confirmed exploitability.

Which Tomcat versions are affected?

Apache lists:

11.0.0-M1 through 11.0.21
10.1.0-M1 through 10.1.54
9.0.0.M1 through 9.0.117
8.5.0 through 8.5.100
7.0.0 through 7.0.109

(Openwall)

Which Tomcat versions fix CVE-2026-43515?

For supported branches, Apache recommends:

11.0.22 or later
10.1.55 or later
9.0.118 or later

(Openwall)

Why does Apache call the vulnerability Moderate if CVSS is 9.1?

Apache’s severity rating takes the configuration dependency into account. CISA-ADP’s CVSS assessment describes the potential impact once an exploitable configuration exists. NVD displays CISA-ADP’s 9.1 vector rather than an independent NVD score. (NVD)

Does CVE-2026-43515 require authentication?

Potentially no. Under an exploitable configuration, the missing constraint may allow a request to reach functionality without the authentication or role enforcement administrators expected.

Does a public exploit exist?

Public proof-of-concept material is available as of August 2026. (PoC Archive)

Is CVE-2026-43515 in CISA KEV?

No, it was not listed in the CISA Known Exploited Vulnerabilities catalog in the currently available August 2026 data.

Can a WAF completely mitigate the vulnerability?

Not reliably. The request itself may contain no malicious payload. Explicitly blocking unnecessary HTTP methods can reduce exposure, but upgrading Tomcat remains the preferred remediation.

Can Spring Security prevent exploitation?

Potentially.

If Spring Security or application logic independently performs correct authorization before sensitive functionality is executed, it may prevent practical impact. But that does not remove the vulnerable Tomcat behavior, and it should not be assumed without testing.

Are extension patterns required?

The upstream fix and Apache’s regression test specifically address matching multiple extension-based security constraints such as *.html. That is the key configuration pattern associated with CVE-2026-43515. (GitHub)

Final Assessment

CVE-2026-43515 is a good example of why access-control vulnerabilities should not be evaluated solely by CVSS score or software version.

The vulnerability exists inside a subtle part of Apache Tomcat’s authorization pipeline.

When several HTTP-method-specific web resource collections reference the same extension pattern, affected Tomcat versions may fail to evaluate every matching collection. The container may therefore conclude that no relevant constraint exists for a request even though the deployment descriptor clearly defines one.

The patch is small.

The security consequence is not.

A protected resource can move from:

request
   ↓
matching security constraint
   ↓
authentication
   ↓
role authorization
   ↓
application

zu:

request
   ↓
incomplete constraint matching
   ↓
expected authorization rule omitted
   ↓
application

Organizations running Tomcat 11.0.21 or earlier, 10.1.54 or earlier, 9.0.117 or earlier, or unsupported Tomcat 7/8.5 versions should inventory their deployments immediately. Apache’s supported fixed versions are Tomcat 11.0.22, 10.1.55, and 9.0.118 or later. (Apache Tomcat)

For defenders, the highest-confidence assessment combines three pieces of evidence: the effective Tomcat runtime version, the application’s web.xml security-constraint structure, and runtime authorization behavior across different HTTP methods.

For penetration testers and application security engineers, CVE-2026-43515 reinforces an equally important principle: authorization is not merely a property of a URL.

It is a property of the user, resource, operation, HTTP method, and application state together.

Testing only whether GET /protected/resource is denied can miss the real vulnerability.

The better question is whether every operation that should be protected is actually protected.