Improper authorization in Apache Tomcat security constraints (CVE-2026-43515)

When multiple security constraints define an HTTP method constraint for the same extension pattern, only the first method constraint is applied. This incorrect application of security constraints constitutes an improper authorization vulnerability that may allow requests to bypass intended access controls. Affected versions: - Apache Tomcat 11.0.0-M1 to 11.0.21 - Apache Tomcat 10.1.0-M1 to 10.1.54 - Apache Tomcat 9.0.0.M1 to 9.0.117 We recommend updating to: 11.0.22, 10.1.55, 9.0.118. CVSS 9.1 · our assessment: act_now Reference: https://lists.apache.org/thread/746nxfxod0wsocxtmv8pb8nkgmwpc6bb Details: https://vuln.today/cve/CVE-2026-43515