VulnSocial

CVE-2026-43515Disclosure(apache / tomcat)

LOWCVSS 9.1 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch apache tomcat systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.

apache CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-285

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • tomcat

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • General: 1 classified signal
  • Peaked 2d ago at 1 mentions (2026-05-12); latest day: 1
  • 3 total mentions across 3 days

Affected systems

Vendors
apache
Products
tomcat

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-05-12: 1Mentions · 2026-05-14: 1Mentions · 2026-07-03: 1Patch / Workaround · 2026-05-14: 1Technical Details · 2026-05-12: 1Technical Details · 2026-05-14: 105-1205-1407-03
Signal classification2 categories
Disclosure
266.7%
General
133.3%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-05-121
Disclosure1
2026-05-141
Disclosure1
2026-07-031
General1
Full discourse3 posts
  • Upwind Security MDR@UpwindMDR
    Disclosure

    🚨 New Apache Tomcat flaws uncovered - and some could impact authentication & request handling. ⚠️ CVE-2026-43515 – Authorization bypass ⚠️ CVE-2026-41293 – HTTP/2 input validation issue ⚠️ CVE-2026-43512 – Digest authentication bypass If Tomcat is internet-facing, now is a good time to review exposure and patch ASAP. Attackers move fast once details go public. #CyberSecurity #AppSec #ApacheTomcat #CVE

    Post summary

    The post announces the discovery of multiple Apache Tomcat vulnerabilities, highlighting potential authorized bypasses and input validation flaws, and urges prompt patching.

    00020114
    187 followersView on X
  • CERT-PY@CERTpy
    General

    ⚠️ Vulnerabilidades en productos Atlassian ❗ CVE-2026-43515 ❗ CVE-2026-43512 ❗ CVE-2026-41293 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-atlassian-4/ https://t.co/g823YVvIKX

    Post summary

    The post simply lists three Atlassian CVEs and provides two URLs for additional information, without detailing exploitation, patches, or technical aspects.

    00010249
    6.7K followersView on X
  • Kazuki Omo@omokazuki
    Disclosure

    Apache Tomcatの脆弱性(Moderate: CVE-2026-43512, CVE-2026-43515, Low: CVE-2026-41284, CVE-2026-41293, CVE-2026-42498, CVE-2026-43513, CVE-2026-43514) #sios_tech #security #vulnerability #セキュリティ #脆弱性 #linux #tomcat #mod_jk #apache https://security.sios.jp/vulnerability/tomcat-security-vulnerability-20260513/

    Post summary

    The post announces several Apache Tomcat CVEs with their moderate/low severity ratings, but provides no evidence of PoC, exploitation, or patch availability.

    00000222
    371 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appapachetomcat---

Explore more

Back to dashboardapache CVEstomcat vulnerabilities