Moole Vulnerability Database

Find real vulnerabilities before they ship

Critical

CVE-2026-43515

Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.

VectorNETWORK

PublishedMay 12, 2026, 16:16

Published Bysecurity@apache.org

Base Score

Score9.1

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

org.apache.tomcat.embed:tomcat-embed-core(Maven)09.0.118N/A

org.apache.tomcat.embed:tomcat-embed-core(Maven)10.1.0-M110.1.55N/A

org.apache.tomcat.embed:tomcat-embed-core(Maven)11.0.0-M111.0.22N/A

org.apache.tomcat:tomcat(Maven)09.0.118N/A

org.apache.tomcat:tomcat(Maven)10.1.0-M110.1.55N/A

org.apache.tomcat:tomcat(Maven)11.0.0-M111.0.22N/A

org.apache.tomcat:tomcat-catalina(Maven)09.0.118N/A

org.apache.tomcat:tomcat-catalina(Maven)10.1.0-M110.1.55N/A

org.apache.tomcat:tomcat-catalina(Maven)11.0.0-M111.0.22N/A

References

Weakness Type

CWE-285

CVSS Metrics

Base Score

9.1

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Base SeverityCritical

Version

3.1

Attack Vector (AV)

NETWORK