Apache Tomcat - Security constraints not correctly applied — CVE-2026-43515

Summary

Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 Apache Tomcat 9.0.0.M1 to 9.0.117 Older, unsupported versions may also be affected Description: When multiple security constraints defined an HTTP method constraint for the same extension pattern, only the first method constraint was applied. Mitigation: Users of the affected versions should apply one of the following…

Product

maven: org.apache.tomcat.embed:tomcat-embed-core | maven: org.apache.tomcat:tomcat | maven: org.apache.tomcat:tomcat-catalina

What to do

General, cautious steps (verify details in the official source):

• Prioritize patching or mitigation immediately (treat as actively risky).
• Identify affected product versions in your inventory and verify whether you are impacted.
• Apply vendor patches/updates or recommended mitigations as soon as available.
• Read the official advisory for exact affected versions and remediation steps.

Official advisory

• Read the official source
• CVE Record
• NVD

Related advisories