CVE-2026-43515 is an Apache Tomcat authorization vulnerability caused by incorrect processing of security constraints when multiple HTTP method restrictions apply to the same extension-based URL pattern.
At first glance, the vulnerability looks unusually narrow. An application needs a particular style of Servlet security configuration, typically involving an extension mapping such as *.html, *.jsp, or another suffix pattern, together with multiple method-specific constraints. However, when that configuration exists, vulnerable versions of Tomcat may enforce one method constraint while silently failing to apply another.
That changes the security meaning of the application’s deployment descriptor.
A resource that administrators believe is protected by authentication and role-based authorization may therefore become reachable through an HTTP method that should have been restricted.
Apache disclosed CVE-2026-43515 on May 12, 2026 and describes the issue as an Improper Authorization vulnerability. Apache’s Tomcat security pages classify the vulnerability as 보통. Meanwhile, CISA-ADP assigned a CVSS 3.1 score of 9.1 Critical, using the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. NVD currently displays that externally supplied CISA-ADP score rather than its own NVD assessment. (Openwall)
The important point for defenders is therefore not simply the numeric severity.
CVE-2026-43515 should be prioritized according to whether a vulnerable Tomcat installation actually contains the security-constraint pattern required to trigger the flaw.
CVE-2026-43515 at a Glance
| 항목 | 세부 정보 |
|---|---|
| CVE | CVE-2026-43515 |
| 제품 | 아파치 톰캣 |
| 취약점 유형 | Improper Authorization / security constraint bypass |
| Primary component | Tomcat Realm security-constraint matching |
| Apache severity | 보통 |
| CVSS 3.1 from CISA-ADP | 9.1 Critical |
| 공격 벡터 | 네트워크 |
| Privileges required | None under exploitable configurations |
| 사용자 상호 작용 | 없음 |
| Primary condition | Multiple HTTP method constraints associated with the same extension URL pattern |
| Public disclosure | May 12, 2026 |
| Tomcat 11 affected | 11.0.0-M1 through 11.0.21 |
| Tomcat 10 affected | 10.1.0-M1 through 10.1.54 |
| Tomcat 9 affected | 9.0.0.M1 through 9.0.117 |
| Tomcat 8.5 affected | 8.5.0 through 8.5.100 |
| Tomcat 7 affected | 7.0.0 through 7.0.109 |
| Supported fixed releases | 11.0.22, 10.1.55, 9.0.118 |
| CWE | CWE-285 Improper Authorization |
| Public PoC | 예 |
| CISA KEV | Not listed as of August 28, 2026 |
Apache states that CVE-2026-43515 occurs when multiple security constraints define HTTP method constraints for the same extension pattern and only the first method constraint is applied. The issue was reported to the Tomcat security team on April 20, 2026. (아파치 톰캣)
What Is CVE-2026-43515?
CVE-2026-43515 is fundamentally a mismatch between the access-control policy described by a Java web application’s Servlet configuration and the access-control policy actually enforced by vulnerable versions of Apache Tomcat.
Java web applications can define authorization rules inside WEB-INF/web.xml.
For example, administrators can say:
- requests to a particular resource require authentication;
- only users with a specific role may access that resource;
- GET requests should be allowed to one role;
- POST requests should require another role;
- some HTTP methods should be completely denied;
- or access restrictions should apply to every file matching a URL extension.
The Servlet specification models these rules using <security-constraint> 그리고 <web-resource-collection> elements.
A simplified example looks like this:
<security-constraint>
<web-resource-collection>
<web-resource-name>Protected HTML GET</web-resource-name>
<url-pattern>*.html</url-pattern>
<http-method>GET</http-method>
</web-resource-collection>
<web-resource-collection>
<web-resource-name>Protected HTML POST</web-resource-name>
<url-pattern>*.html</url-pattern>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>ADMIN</role-name>
</auth-constraint>
</security-constraint>
Conceptually, the administrator is saying that both GET and POST operations against resources matching *.html should be protected by the constraint.
On affected Tomcat versions, however, the internal matching algorithm could find the extension match in the first resource collection and fail to correctly evaluate subsequent collections sharing that extension pattern.
The result could be:
GET /protected/secret.html
↓
*.html matches
↓
GET constraint found
↓
Authorization enforced
while another method followed a different path:
POST /protected/secret.html
↓
*.html matches first collection
↓
First collection covers GET, not POST
↓
Later *.html POST collection incorrectly ignored
↓
Expected constraint may not be returned
↓
Authorization protection can be bypassed
That is the heart of the Tomcat security constraint bypass.
Authentication Bypass or Authorization Bypass?
This distinction matters.
CVE-2026-43515 is more accurately described as an authorization bypass 또는 security constraint bypass, rather than a universal Tomcat authentication bypass.
Authentication answers:
Who is this user?
Authorization answers:
Is this user allowed to perform this operation on this resource?
The Tomcat bug occurs while determining which security constraints apply to a request. Therefore, the root problem is authorization enforcement.
However, the observable impact may look like an authentication bypass in a vulnerable application.
Suppose a normally protected POST endpoint requires an authenticated ADMIN user. If the method-specific security constraint is not selected at all, an unauthenticated request may reach application code.
From the attacker’s point of view, that looks like:
Unauthenticated request
↓
Protected endpoint
↓
Expected authentication challenge missing
↓
Request succeeds
But the underlying defect is that Tomcat failed to select the authorization constraint that should have triggered the authentication and role checks.
Red Hat similarly describes the vulnerability as allowing a remote attacker to bypass intended security restrictions for information or actions within an application. (레드햇 고객 포털)
How Tomcat Security Constraints Are Supposed to Work
Understanding CVE-2026-43515 requires understanding Servlet security constraints.
The Jakarta Servlet specification defines a security constraint as a combination of:
Web Resource Collection
+
Authorization Constraint
+
Optional User Data Constraint
The web resource collection determines which HTTP requests are covered.
It may include:
<url-pattern>/admin/*</url-pattern>
or:
<url-pattern>*.html</url-pattern>
It can also restrict the policy to specific methods:
<http-method>GET</http-method>
or exclude certain methods:
<http-method-omission>GET</http-method-omission>
The authorization section then determines who can access those resources.
예를 들어
<auth-constraint>
<role-name>ADMIN</role-name>
</auth-constraint>
The Jakarta Servlet 6.1 specification explicitly explains that a web resource collection consists of URL patterns plus HTTP methods or method omissions, and that authorization constraints determine which roles can perform the constrained requests. (jakarta.ee)
The important concept is that Tomcat must combine the URL and method dimensions correctly.
A request is not simply:
/protected/data.html
It is effectively:
GET + /protected/data.html
or:
POST + /protected/data.html
or:
DELETE + /protected/data.html
Two requests for the same URI can therefore have entirely different authorization requirements.
URL Pattern Matching Makes the Vulnerability More Subtle
Servlet containers support several forms of URL mapping.
Typical patterns include:
/admin/report
for an exact match,
/admin/*
for a path-prefix match,
and:
*.html
for an extension match.
The Tomcat fix specifically refers to ensuring that RealmBase finds all matching extension-based constraints. The upstream patch therefore tells us precisely where the bug existed: the problem occurred while processing suffix-style patterns such as *.html. (GitHub)
That is important because a security team performing a simple search for:
<security-constraint>
will produce too many false positives.
The higher-value audit target is:
extension pattern
+
multiple resource collections
+
method-specific restrictions
예를 들어
<url-pattern>*.html</url-pattern>
<http-method>GET</http-method>
appearing alongside another collection such as:
<url-pattern>*.html</url-pattern>
<http-method>POST</http-method>
is much more interesting than a generic constraint covering /admin/* without method differentiation.
Root Cause Inside RealmBase.findSecurityConstraints()
Apache’s patch provides a particularly clear explanation of the implementation bug.
The relevant code lives in:
org.apache.catalina.realm.RealmBase
and specifically:
findSecurityConstraints(Request request, Context context)
The fixed Tomcat 11 commit is 276087d9, while corresponding patches were applied to other maintained branches, including c6213173 for Tomcat 10.1 and db919ff9 for Tomcat 9. (아파치 톰캣)
Before the fix, the extension-matching portion of the algorithm effectively maintained state resembling:
boolean matched = false;
int pos = -1;
outside the loop over security collections.
When an extension pattern matched, Tomcat recorded which collection matched.
It then later used something conceptually equivalent to:
collection[pos].findMethod(method)
to determine whether the HTTP method was covered.
The flaw was that several resource collections could match the same extension.
Consider:
Collection 0
Pattern: *.html
Method: GET
Collection 1
Pattern: *.html
Method: POST
For:
POST /protected/secret.html
both collections match at the URL-pattern level.
But only the second collection matches at the HTTP-method level.
The vulnerable algorithm could stop with or otherwise retain the first extension match and test POST against the GET collection.
That produced:
*.html → yes
POST in GET collection → no
instead of continuing to ask:
Does another *.html collection contain POST?
The patch changes the logic so that matching is evaluated per collection.
The critical behavior becomes conceptually:
for each SecurityCollection:
matched = false
for each pattern:
if extension matches:
matched = true
if matched:
found = true
if thisCollection.findMethod(requestMethod):
add constraint
This seemingly small placement change is security-significant.
The official Tomcat commit describes the fix as:
“Ensure RealmBase finds all matching extension based constraints”
and the patch moves matched into the loop that evaluates each collection, allowing every relevant collection to participate in method matching. (GitHub)
Apache Added a Regression Test That Shows the Exact Failure Pattern
The Apache patch also added a regression test.
That test creates one security constraint and adds two collections.
The first contains:
getCollection.addMethod(Method.GET);
getCollection.addPatternDecoded("*.html");
and the second contains:
postCollection.addMethod(Method.POST);
postCollection.addPatternDecoded("*.html");
Apache then verifies authorization independently for both GET and POST requests.
This is valuable evidence because it narrows the vulnerability condition considerably: the bug is specifically about more than one matching extension-based resource collection being relevant to method-based authorization. (GitHub)
In other words, CVE-2026-43515 is not a generic failure of every <security-constraint>.
It is a failure of constraint resolution under a particular overlapping-pattern condition.
A Simplified Vulnerable Configuration
A representative deployment descriptor might look like:
<security-constraint>
<web-resource-collection>
<web-resource-name>Admin GET</web-resource-name>
<url-pattern>*.html</url-pattern>
<http-method>GET</http-method>
</web-resource-collection>
<web-resource-collection>
<web-resource-name>Admin POST</web-resource-name>
<url-pattern>*.html</url-pattern>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>ADMIN</role-name>
</auth-constraint>
</security-constraint>
An administrator reading the configuration naturally expects:
GET *.html → ADMIN
POST *.html → ADMIN
A patched container should enforce both.
The vulnerable behavior can instead resemble:
| 요청 | Intended | Vulnerable behavior |
|---|---|---|
GET /secret.html | Require ADMIN | Protected |
POST /secret.html | Require ADMIN | Constraint may be omitted |
GET /public.txt | Not covered | Normal application behavior |
POST /public.txt | Not covered | Normal application behavior |
The exact HTTP response still depends on the application.
A bypass does not guarantee that every POST request returns sensitive information. Application code, Spring Security, reverse proxies, custom filters, or other controls may independently reject the request.
But relying on those additional layers does not make the Tomcat bug harmless.
The deployment descriptor’s security guarantee has already failed.
Why HTTP Method Switching Can Become Dangerous
Many web applications assign dramatically different semantics to HTTP methods.
예를 들어
GET /account/profile.html
might only display information.
But:
POST /account/profile.html
might update account information.
Likewise:
GET /admin/user.html
could show a form,
while:
POST /admin/user.html
could create or modify a privileged account.
A method-specific authorization bypass is therefore potentially more serious than a read-only access-control failure.
An affected application could theoretically expose operations involving:
account modification
administrative changes
workflow approval
record deletion
file operations
credential changes
configuration changes
business transactions
The actual impact must be evaluated at the application layer.
This is one reason CISA-ADP’s CVSS vector assigns both confidentiality and integrity impacts as High while leaving availability at None. (NVD)
Affected Apache Tomcat Versions
Apache lists the following versions as affected:
| Branch | 영향을 받는 |
|---|---|
| Apache Tomcat 11 | 11.0.0-M1 through 11.0.21 |
| Apache Tomcat 10.1 | 10.1.0-M1 through 10.1.54 |
| Apache Tomcat 9 | 9.0.0.M1 through 9.0.117 |
| Apache Tomcat 8.5 | 8.5.0 through 8.5.100 |
| Apache Tomcat 7 | 7.0.0 through 7.0.109 |
| Earlier than Tomcat 7 | Impact listed as unknown |
Apache recommends upgrading maintained deployments to:
Tomcat 11.0.22 or later
Tomcat 10.1.55 or later
Tomcat 9.0.118 or later
These version ranges are consistent across the Apache advisory, NVD, GitHub Advisory Database, and oss-security disclosure. (Openwall)
Tomcat 7 and Tomcat 8.5 deserve additional attention.
These branches are already unsupported. Organizations should not interpret their absence from the recommended current-version list as meaning they are safe.
Apache explicitly identifies Tomcat 7.0.0–7.0.109 and 8.5.0–8.5.100 as affected. The appropriate long-term remediation is migration to a supported Tomcat branch rather than continuing to depend on end-of-life software. (Openwall)
Tomcat 11
CVE-2026-43515 affects:
11.0.0-M1
through
11.0.21
Tomcat 11.0.22 contains the fix.
The Tomcat 11 security page records the issue under the release dated May 5, 2026 and links it to commits 276087d9 그리고 06597486. (아파치 톰캣)
Tomcat 10.1
CVE-2026-43515 affects:
10.1.0-M1
through
10.1.54
The supported fixed release is:
10.1.55
Apache identifies commit:
c6213173
as the primary fix for this branch. (아파치 톰캣)
Tomcat 9
Affected versions are:
9.0.0.M1
through
9.0.117
The vulnerability is fixed in:
9.0.118
with the corresponding branch fix:
db919ff9
(아파치 톰캣)
CVE-2026-43515 Severity: Moderate or Critical?
One of the most confusing aspects of this CVE is severity.
Apache calls it:
보통
while GitHub Advisory Database displays:
9.1 Critical
Both can be true within their respective scoring frameworks.
Apache’s rating reflects the fact that exploitation requires a relatively specific application configuration.
The vulnerability does not mean:
Internet
↓
Any Tomcat server
↓
Authentication instantly bypassed
Instead, the path is closer to:
Affected Tomcat
+
extension-based URL security constraints
+
multiple relevant method constraints
+
valuable application functionality behind them
↓
security impact
That configuration dependency lowers broad population-level exploitability.
CVSS, however, focuses heavily on the characteristics of an attack once the vulnerable condition exists.
CISA-ADP records:
AV:N
AC:L
PR:N
UI:N
S:U
C:H
I:H
A:N
which produces 9.1.
That means:
Network attack vector: exploitation can occur remotely through HTTP.
Low attack complexity: once the required configuration exists, exploitation does not necessarily require complex race conditions or advanced primitives.
No privileges required: an unauthenticated remote user may trigger the affected path.
No user interaction: no victim needs to click a link or open a document.
High confidentiality impact: protected information could potentially become accessible.
High integrity impact: protected actions could potentially become executable.
No direct availability impact: denial of service is not the central vulnerability.
NVD had not published its own separate CVSS assessment in the retrieved record and displays the 9.1 CISA-ADP score. (NVD)
Therefore, defenders should avoid arguing over whether the vulnerability is “Moderate” or “Critical.”
Ask a more useful question:
Does our application contain the vulnerable security-constraint structure, and what business operations are behind those constraints?
Is CVE-2026-43515 Being Exploited?
As of August 28, 2026, public proof-of-concept material exists for CVE-2026-43515.
A publicly indexed PoC environment demonstrates the issue using an affected Tomcat instance, an extension-based web.xml constraint configuration, and different HTTP methods to compare protected versus unexpectedly accessible behavior. (PoC Archive)
However, public PoC availability is not equivalent to confirmed widespread exploitation.
CISA’s SSVC data recorded by NVD marked exploitation as:
없음
while also describing the vulnerability as automatable with potentially total technical impact under the assessed scenario. (NVD)
Rapid7 also reports that CVE-2026-43515 is not currently in the CISA Known Exploited Vulnerabilities catalog.
That distinction matters.
The current situation is better summarized as:
Public vulnerability details: Yes
Patch diff: Yes
Public PoC: Yes
Network reachable attack surface: Potentially
Confirmed CISA KEV exploitation: No
Reason to delay patching: No
A public patch plus a small and understandable access-control bug makes reproduction considerably easier than it was at initial disclosure.
How an Attacker Would Think About CVE-2026-43515
From a security-testing perspective, identifying an affected Tomcat version is only step one.
A version banner such as:
Apache Tomcat/10.1.52
does not prove exploitability.
The attacker still needs an application whose security policy exposes the vulnerable constraint arrangement.
The logical reconnaissance sequence is therefore:
Identify Tomcat
↓
Estimate version
↓
Identify protected extension-based resources
↓
Compare behavior across HTTP methods
↓
Look for inconsistent authentication challenges
↓
Determine whether application functionality becomes reachable
The highest-value signal is authorization asymmetry between methods.
Imagine:
GET /private/report.html
returns:
HTTP/1.1 401 Unauthorized
while:
POST /private/report.html
unexpectedly reaches the application.
That is far more interesting than the version number alone.
Safe Validation of CVE-2026-43515
Testing should only be performed against systems you own or are explicitly authorized to assess.
A defensive validation strategy does not need destructive payloads.
Start with a known protected resource and compare authentication behavior across methods.
예를 들어
curl -i http://127.0.0.1:8080/app/protected/test.html
Then:
curl -i -X POST \
http://127.0.0.1:8080/app/protected/test.html
You are looking for differences such as:
GET → 401
POST → 200
or:
GET → 403
POST → application response
The most convincing result is not simply a status-code difference.
Different HTTP methods often legitimately return different codes.
Instead, correlate the response with the expected authorization policy.
A valid test asks:
Was POST supposed to require the same security role?
If yes, yet Tomcat processes it without the expected authentication or role check, investigation is warranted.
A safe lab should preferably use a non-sensitive endpoint whose handler only returns something like:
METHOD_REACHED
rather than testing against production operations.
Why Generic Vulnerability Scanning May Miss the Issue
CVE-2026-43515 is difficult to detect reliably with a pure version scanner.
Version scanning can tell you:
Tomcat 10.1.52
→ potentially affected
but cannot necessarily determine:
Does web.xml use overlapping extension constraints?
Conversely, black-box HTTP testing may identify inconsistent method behavior but not know whether the cause is CVE-2026-43515, custom application authorization, proxy routing, Spring Security, or another middleware component.
High-confidence detection therefore benefits from combining:
software inventory
+
deployment descriptor analysis
+
HTTP behavior
This is a good example of why vulnerability management should distinguish between:
vulnerable software
and:
exploitable application configuration.
How to Audit web.xml for CVE-2026-43515
Search deployed applications for:
WEB-INF/web.xml
and inspect <security-constraint> definitions.
Start by identifying extension patterns:
<url-pattern>*.html</url-pattern>
<url-pattern>*.jsp</url-pattern>
<url-pattern>*.do</url-pattern>
or custom suffixes.
Then look for method-specific rules:
<http-method>GET</http-method>
<http-method>POST</http-method>
<http-method>PUT</http-method>
<http-method>DELETE</http-method>
A configuration becomes particularly relevant when the same suffix appears in several web resource collections associated with different methods.
예를 들어
<web-resource-collection>
<url-pattern>*.do</url-pattern>
<http-method>GET</http-method>
</web-resource-collection>
<web-resource-collection>
<url-pattern>*.do</url-pattern>
<http-method>POST</http-method>
</web-resource-collection>
That does not automatically prove exploitation.
But on an affected Tomcat release, it is exactly the type of configuration that deserves immediate testing and remediation.
Static Detection Script
Defenders can perform a basic configuration audit with a simple local script.
The following example looks for repeated extension patterns associated with method-specific resource collections:
from pathlib import Path
import xml.etree.ElementTree as ET
from collections import defaultdict
web_xml = Path("WEB-INF/web.xml")
tree = ET.parse(web_xml)
root = tree.getroot()
patterns = defaultdict(list)
for elem in root.iter():
if not elem.tag.endswith("web-resource-collection"):
continue
url_patterns = []
methods = []
for child in elem:
tag = child.tag.split("}")[-1]
if tag == "url-pattern" and child.text:
url_patterns.append(child.text.strip())
if tag == "http-method" and child.text:
methods.append(child.text.strip())
for pattern in url_patterns:
if pattern.startswith("*."):
patterns[pattern].append(methods)
for pattern, method_sets in patterns.items():
if len(method_sets) > 1:
print(f"[REVIEW] repeated extension pattern: {pattern}")
for methods in method_sets:
print(" methods:", methods or ["ALL"])
This is not a complete vulnerability scanner.
It is a triage mechanism.
Namespace handling, annotation-based security, generated descriptors, framework-level controls, multiple applications, and container-level configuration can complicate analysis.
But it can quickly identify applications that deserve deeper review.
Check Embedded Tomcat Too
Traditional Tomcat deployments are only one part of the exposure.
Applications may bundle Tomcat libraries through Maven dependencies.
GitHub Advisory Database identifies affected Maven packages including:
org.apache.tomcat.embed:tomcat-embed-core
org.apache.tomcat:tomcat
org.apache.tomcat:tomcat-catalina
with fixed versions corresponding to Tomcat 9.0.118, 10.1.55, and 11.0.22. (GitHub)
This is especially relevant to Spring Boot environments.
Security teams should therefore avoid checking only:
/usr/local/tomcat/
or standalone server inventories.
Also inspect:
pom.xml
pom.lock-style dependency reports
Gradle dependencies
SBOMs
container images
fat JAR contents
transitive dependencies
For Maven-based projects, dependency inventory may reveal:
<dependency>
<groupId>org.apache.tomcat.embed</groupId>
<artifactId>tomcat-embed-core</artifactId>
</dependency>
The effective version matters more than whether developers explicitly remember installing Tomcat.
Detecting Suspicious Behavior in HTTP Logs
CVE-2026-43515 does not have a unique network signature.
There is no special exploit string comparable to an SQL injection payload.
The attacker may simply change the HTTP method.
예를 들어
GET /secure/report.html
POST /secure/report.html
PUT /secure/report.html
The most useful behavioral signal is therefore inconsistent authorization results.
A possible sequence might look like:
203.0.113.25 - - [28/Aug/2026:10:31:05] "GET /admin/report.html HTTP/1.1" 401
203.0.113.25 - - [28/Aug/2026:10:31:07] "HEAD /admin/report.html HTTP/1.1" 401
203.0.113.25 - - [28/Aug/2026:10:31:09] "POST /admin/report.html HTTP/1.1" 200
A single POST request returning 200 is not evidence of exploitation.
But the combination of:
same source
+
same URI
+
rapid method switching
+
authentication failures followed by success
is useful hunting data.
Example Detection Logic
A SIEM hunting strategy could conceptually group requests by:
source IP
URI
short time window
and alert when:
method A → 401/403
method B → 2xx
against known protected extension-based resources.
Pseudocode:
WHERE uri matches "*.html" OR "*.jsp" OR known protected extension
GROUP BY src_ip, uri
WINDOW 5 minutes
IF
failed_auth_methods >= 1
AND
successful_other_methods >= 1
THEN
investigate
This should not be deployed as a high-confidence standalone alert because legitimate REST behavior can produce similar patterns.
It works better when correlated with known CVE-2026-43515 exposure.
왜 <deny-uncovered-http-methods> Still Matters
The Jakarta Servlet specification explicitly warns developers about uncovered HTTP methods.
When security constraints enumerate only specific HTTP methods, methods outside those enumerations may remain uncovered.
The specification recommends, where appropriate, using:
<deny-uncovered-http-methods/>
and ensuring that every allowed HTTP method is intentionally covered. (jakarta.ee)
This is not a substitute for patching CVE-2026-43515.
The vulnerability occurs because Tomcat incorrectly evaluates constraints that administrators did define.
Nevertheless, reducing method ambiguity is good defense-in-depth.
A secure design should avoid depending on assumptions such as:
Nobody will use PUT here anyway.
If PUT should not be permitted, deny it.
If DELETE should not be permitted, deny it.
If only GET and POST are valid, define that security posture explicitly.
해결 방법
The preferred mitigation is straightforward:
Upgrade Tomcat.
For maintained branches:
Tomcat 11 → 11.0.22 or later
Tomcat 10.1 → 10.1.55 or later
Tomcat 9 → 9.0.118 or later
Apache explicitly recommends these versions in its advisory. (Openwall)
Do not stop at exactly those patch versions if a newer maintained security release is available.
예를 들어
10.1.55
should be interpreted as:
10.1.55 or newer supported 10.1.x release
not as a reason to downgrade a system already running a later patched release.
What About Tomcat 7 and 8.5?
Migrate.
Tomcat 7 and Tomcat 8.5 are end-of-life branches, and Apache still identifies them as affected by CVE-2026-43515. (Openwall)
Continuing to run obsolete branches turns vulnerability remediation into an endless backporting problem.
The safer migration direction is:
Tomcat 7 / 8.5
↓
supported application compatibility assessment
↓
supported Tomcat branch
↓
current security release
Legacy application compatibility may make this difficult, particularly around Servlet API changes, javax.* versus jakarta.*, older frameworks, and Java runtime requirements.
That operational difficulty does not reduce the security risk of keeping an unsupported container in production.
Temporary Configuration Mitigation
If an emergency upgrade cannot immediately be completed, review overlapping extension-based method constraints and simplify the configuration.
For example, rather than relying on multiple resource collections sharing:
<url-pattern>*.html</url-pattern>
consider whether the security model can protect the entire extension without method-specific differentiation:
<security-constraint>
<web-resource-collection>
<web-resource-name>Protected HTML</web-resource-name>
<url-pattern>*.html</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>ADMIN</role-name>
</auth-constraint>
</security-constraint>
Now the authorization policy applies to all methods covered by that URL pattern.
Whether this is suitable depends on the application.
Do not blindly modify production web.xml files without understanding how legitimate operations depend on method-specific policies.
And configuration changes should be treated as temporary risk reduction, not as a replacement for installing the upstream fix.
Reverse Proxy Mitigation
Organizations that know exactly which methods are required for a protected application may also enforce HTTP methods at an upstream proxy.
Conceptually:
Internet
↓
Reverse Proxy
↓
Allowed methods only
↓
Tomcat
For a read-only endpoint:
Allow: GET, HEAD
Deny: POST, PUT, PATCH, DELETE
can reduce exposure.
Again, this is defense-in-depth.
The proxy does not fix Tomcat’s incorrect constraint-selection logic.
It merely prevents some requests from reaching it.
Application-Level Authorization Is Important
Servlet container security should not necessarily be the application’s only authorization layer.
Sensitive operations benefit from application-level authorization checks as well.
예를 들어
if (!currentUser.hasRole("ADMIN")) {
throw new AccessDeniedException();
}
or framework equivalents.
In a layered architecture:
Reverse proxy policy
↓
Tomcat security constraint
↓
Framework authorization
↓
Business-logic authorization
one failed control does not automatically expose the business operation.
CVE-2026-43515 demonstrates why this matters.
A deployment descriptor may look correct while the container processes it incorrectly.
Do WAFs Stop CVE-2026-43515?
Usually not reliably.
There is no inherently malicious payload.
An exploit request may look syntactically normal:
POST /protected/account.html HTTP/1.1
Host: example.com
Content-Length: 0
Nothing about that request screams exploitation.
The security failure exists in the server’s interpretation of its authorization configuration.
A WAF can help if it knows that POST should never reach the endpoint.
But generic attack signatures are unlikely to provide dependable protection.
This makes configuration-aware detection more valuable than payload-based signatures.
Why CVE-2026-43515 Matters for Pentesters
The vulnerability is a useful reminder that access-control testing must be method-aware.
A common test pattern is:
request protected page
→ get 401
→ mark protected
→ move on
That is insufficient.
For security-sensitive routes, testers should consider:
GET
HEAD
POST
PUT
PATCH
DELETE
OPTIONS
according to application semantics and authorization scope.
The interesting question is not:
Can I access this URL?
It is:
Can I perform any operation on this resource that the authorization policy should prohibit?
CVE-2026-43515 is almost a textbook example of that distinction.
Why Black-Box Testing Alone Can Produce False Positives
Imagine:
GET /admin/task.html → 401
POST /admin/task.html → 200
That looks suspicious.
But perhaps POST is intentionally public.
Maybe the endpoint implements a webhook.
Maybe a framework filter handles GET and POST differently.
Maybe authentication is performed inside application code and the 200 response contains only:
{"error":"authentication_required"}
rather than sensitive content.
Therefore, status code alone is not enough.
A strong validation chain contains:
1. Vulnerable Tomcat version
2. Relevant extension-based security constraint
3. Multiple method-specific collections
4. Expected authorization requirement
5. Request demonstrating enforcement difference
6. Evidence that unauthorized functionality or information is actually reachable
That produces a far more defensible finding.
Why Static Analysis Alone Can Also Produce False Positives
The opposite problem exists.
An analyst might find:
*.html + GET
*.html + POST
내부 web.xml.
But the deployed Tomcat may already be patched.
Or an application may never expose URLs matching the constraint.
Or an upstream gateway may block the relevant method.
Or additional application-layer authorization may eliminate practical impact.
This is why security assessment should combine static configuration analysis with runtime verification.
Suggested Exposure Classification
A practical vulnerability-management model is:
| Level | Condition |
|---|---|
| Potential | Vulnerable Tomcat version |
| Configuration-relevant | Vulnerable version plus overlapping extension/method constraints |
| Reachable | Relevant protected resource reachable over network |
| Behavior confirmed | HTTP method demonstrates constraint inconsistency |
| Exploitable | Unauthorized information or functionality is actually accessible |
This is far more useful than treating every Tomcat installation below the patched version as equally dangerous.
CVE-2026-43515 vs CVE-2026-55956
CVE-2026-43515 is not the only Tomcat security-constraint issue disclosed in 2026.
Apache later disclosed CVE-2026-55956, another Moderate vulnerability involving security constraints.
However, the root conditions are different.
For CVE-2026-55956, Apache states that when security constraints were specified for the default servlet, configured HTTP methods or method omissions could be ignored. The issue affected Tomcat 10.1 through 10.1.55 before being fixed in 10.1.56, with corresponding impacts on other branches. (아파치 톰캣)
The distinction can be summarized as:
| CVE | Core issue |
|---|---|
| CVE-2026-43515 | Multiple method constraints sharing the same extension pattern |
| CVE-2026-55956 | Method handling for constraints associated with the default servlet |
They should not be merged into one generic “Tomcat authentication bypass” finding.
CVE-2026-43515 vs CVE-2026-24733
CVE-2026-24733 was another Tomcat security constraint bypass.
Its cause was different again.
Apache states that Tomcat did not limit HTTP/0.9 requests to GET. Under a configuration where HEAD was allowed but GET was denied, a specially structured HTTP/0.9 request could bypass the intended constraint. (아파치 톰캣)
This comparison shows a broader pattern worth understanding:
Authorization policy
↓
HTTP parsing / method interpretation
↓
URL mapping
↓
constraint selection
↓
enforcement
A flaw anywhere in this chain can create a security-control bypass even when the web.xml configuration itself looks reasonable.
CVE-2026-43515 vs CVE-2025-66614
CVE-2025-66614 involved Tomcat client-certificate authentication rather than HTTP method constraint resolution.
In that vulnerability, differing SNI and HTTP Host values could matter when virtual hosts had different TLS client-certificate requirements and authentication was enforced only at the Connector. Apache explicitly notes that the flaw did not apply when client-certificate authentication was enforced at the web-application level. (아파치 톰캣)
Again, the theme is layered security enforcement.
CVE-2025-66614 affected the relationship between:
TLS virtual host selection
and
HTTP virtual host selection
while CVE-2026-43515 affects:
URL extension selection
and
HTTP method authorization
Both demonstrate why container-level authentication and authorization logic deserves the same attention as application vulnerabilities.
Patch Diff Analysis Is Particularly Valuable Here
CVE advisories frequently provide only a one-paragraph description.
CVE-2026-43515 is a good case where the upstream patch dramatically improves understanding.
The disclosure says:
only the first method constraint was applied.
The code diff reveals why.
The regression test reveals the minimal arrangement needed to reproduce it.
This gives defenders three independent forms of evidence:
Vendor advisory
↓
Source patch
↓
Regression test
For vulnerability research, that is substantially stronger than relying on secondary CVE summaries.
Security Teams Should Search for the Configuration, Not Just the CVE
A high-value enterprise hunt can be structured around three questions.
First:
Which systems run affected Tomcat versions?
Second:
Which deployed applications use extension-based security constraints?
Third:
Which of those applications divide authorization by HTTP method?
Intersect the three sets:
Affected version
∩
extension mapping
∩
multiple method rules
=
highest-priority assets
That can reduce hundreds of potential vulnerable components to a much smaller number of genuinely important applications.
SBOM and Dependency Scanning
For embedded Tomcat, dependency scanners should flag affected versions of relevant artifacts.
예를 들어
org.apache.tomcat.embed:tomcat-embed-core
A useful remediation workflow is:
SBOM
↓
identify Tomcat component
↓
map to CVE-2026-43515
↓
verify effective runtime version
↓
inspect security configuration
↓
upgrade
↓
runtime validation
Dependency scanning solves the inventory problem.
It does not completely solve the exploitability problem.
Container Image Hunting
Tomcat often appears in Docker and Kubernetes environments.
Search image inventories for:
tomcat:9
tomcat:10
tomcat:11
but do not stop with official Tomcat image names.
Application images may contain Tomcat dependencies without exposing the word Tomcat in their image tag.
Useful sources include:
SBOM package inventory
Maven dependencies
JAR manifests
application startup logs
container filesystem
Java process command line
Kubernetes security teams should map vulnerable application images back to:
Deployment
StatefulSet
Namespace
Ingress
external exposure
service account
business owner
so patch priority reflects reachable risk.
Post-Patch Verification
After upgrading, repeat the authorization tests.
Do not assume package installation alone proves successful remediation.
확인합니다:
curl -i \
http://127.0.0.1:8080/app/protected/test.html
and:
curl -i \
-X POST \
http://127.0.0.1:8080/app/protected/test.html
Both methods should now behave according to the intended security policy.
Also confirm the runtime version actually changed.
Containers, immutable images, stale pods, blue-green deployments, and embedded application dependencies can leave old instances running even after engineers believe a patch has been deployed.
Recommended Incident-Hunting Questions
If an affected application was internet-facing before remediation, defenders should review historical telemetry.
Useful questions include:
Were protected extension-based URLs accessed through unusual HTTP methods?
Did a source receive 401 or 403 for one method and later succeed using another?
Were administrative actions executed without an associated authenticated session?
Did method-switching activity originate from scanning infrastructure?
Were affected endpoints reachable before the patch date?
Did any reverse proxy normalize or rewrite methods before Tomcat?
The absence of a CISA KEV listing does not prove that no exploitation occurred against a particular organization.
It only means confirmed exploitation has not triggered that catalog status.
Hardening Checklist
Organizations operating Apache Tomcat should adopt several controls beyond the immediate CVE patch.
Keep Tomcat on a supported branch. Running Tomcat 7 or 8.5 dramatically increases long-term exposure.
Minimize method-specific container authorization where possible. Simpler security policies are easier to reason about and test.
Explicitly deny unwanted HTTP methods. Do not rely on an application simply “not using” PUT, PATCH, or DELETE.
사용 <deny-uncovered-http-methods> where appropriate. The Servlet specification specifically provides this mechanism to reduce accidental method exposure. (jakarta.ee)
Enforce sensitive authorization inside the application as well. Container controls should not necessarily be the final authorization decision for high-risk operations.
Test authorization matrices automatically. Every important route should have tests covering roles, authentication states, and HTTP methods.
Monitor method anomalies. Method switching against a protected URI is useful reconnaissance telemetry.
Inventory embedded Tomcat dependencies. Standalone servers are only part of the problem.
Example Authorization Test Matrix
Instead of testing only URLs, security teams can model access like this:
| 엔드포인트 | Method | Anonymous | USER | ADMIN |
|---|---|---|---|---|
/admin/report.html | GET | Deny | Deny | Allow |
/admin/report.html | POST | Deny | Deny | Allow |
/admin/report.html | PUT | Deny | Deny | Deny |
/profile/account.html | GET | Deny | Allow | Allow |
/profile/account.html | POST | Deny | Allow | Allow |
Automated testing can then verify every cell.
For CVE-2026-43515, the critical failure would look like:
| 엔드포인트 | Method | Expected | Actual |
|---|---|---|---|
/admin/report.html | GET | 401 | 401 |
/admin/report.html | POST | 401 | 200 |
This is a much stronger detection method than checking whether a login page exists.
Frequently Asked Questions
What is CVE-2026-43515?
CVE-2026-43515 is an Apache Tomcat Improper Authorization vulnerability in which multiple HTTP method security constraints associated with the same extension-based URL pattern may not all be correctly applied.
Is CVE-2026-43515 an authentication bypass?
It is technically an authorization/security-constraint bypass. In some configurations the result can allow an unauthenticated request to reach a resource that should have triggered authentication, so the practical effect may resemble an authentication bypass.
Is every vulnerable Tomcat server exploitable?
No.
The relevant security-constraint configuration needs to exist. A vulnerable version alone establishes potential exposure, not confirmed exploitability.
Which Tomcat versions are affected?
Apache lists:
11.0.0-M1 through 11.0.21
10.1.0-M1 through 10.1.54
9.0.0.M1 through 9.0.117
8.5.0 through 8.5.100
7.0.0 through 7.0.109
(Openwall)
Which Tomcat versions fix CVE-2026-43515?
For supported branches, Apache recommends:
11.0.22 or later
10.1.55 or later
9.0.118 or later
(Openwall)
Why does Apache call the vulnerability Moderate if CVSS is 9.1?
Apache’s severity rating takes the configuration dependency into account. CISA-ADP’s CVSS assessment describes the potential impact once an exploitable configuration exists. NVD displays CISA-ADP’s 9.1 vector rather than an independent NVD score. (NVD)
Does CVE-2026-43515 require authentication?
Potentially no. Under an exploitable configuration, the missing constraint may allow a request to reach functionality without the authentication or role enforcement administrators expected.
Does a public exploit exist?
Public proof-of-concept material is available as of August 2026. (PoC Archive)
Is CVE-2026-43515 in CISA KEV?
No, it was not listed in the CISA Known Exploited Vulnerabilities catalog in the currently available August 2026 data.
Can a WAF completely mitigate the vulnerability?
Not reliably. The request itself may contain no malicious payload. Explicitly blocking unnecessary HTTP methods can reduce exposure, but upgrading Tomcat remains the preferred remediation.
Can Spring Security prevent exploitation?
Potentially.
If Spring Security or application logic independently performs correct authorization before sensitive functionality is executed, it may prevent practical impact. But that does not remove the vulnerable Tomcat behavior, and it should not be assumed without testing.
Are extension patterns required?
The upstream fix and Apache’s regression test specifically address matching multiple extension-based security constraints such as *.html. That is the key configuration pattern associated with CVE-2026-43515. (GitHub)
Final Assessment
CVE-2026-43515 is a good example of why access-control vulnerabilities should not be evaluated solely by CVSS score or software version.
The vulnerability exists inside a subtle part of Apache Tomcat’s authorization pipeline.
When several HTTP-method-specific web resource collections reference the same extension pattern, affected Tomcat versions may fail to evaluate every matching collection. The container may therefore conclude that no relevant constraint exists for a request even though the deployment descriptor clearly defines one.
The patch is small.
The security consequence is not.
A protected resource can move from:
request
↓
matching security constraint
↓
authentication
↓
role authorization
↓
application
에:
request
↓
incomplete constraint matching
↓
expected authorization rule omitted
↓
application
Organizations running Tomcat 11.0.21 or earlier, 10.1.54 or earlier, 9.0.117 or earlier, or unsupported Tomcat 7/8.5 versions should inventory their deployments immediately. Apache’s supported fixed versions are Tomcat 11.0.22, 10.1.55, and 9.0.118 or later. (아파치 톰캣)
For defenders, the highest-confidence assessment combines three pieces of evidence: the effective Tomcat runtime version, the application’s web.xml security-constraint structure, and runtime authorization behavior across different HTTP methods.
For penetration testers and application security engineers, CVE-2026-43515 reinforces an equally important principle: authorization is not merely a property of a URL.
It is a property of the user, resource, operation, HTTP method, and application state together.
Testing only whether GET /protected/resource is denied can miss the real vulnerability.
The better question is whether every operation that should be protected is actually protected.
Korean 
English 
German 
French 
Spanish 
Portuguese 
Japanese 
Hindi 
Arabic 
Turkish 
Hebrew