Apache Tomcat CVE-2026-43515

The vulnerable application must be running an affected Tomcat version and, critically, its deployment descriptor (web.xml) must define multiple method constraints that specify an HTTP method for the same URL extension - this overlapping security-constraint configuration is the exact prerequisite named in the advisory. Per CVSS AV:N/AC:L/PR:N/UI:N, no authentication or user interaction is required and it is remotely reachable, but exploitation is limited to applications using this specific overlapping-constraint pattern; default installations and applications that do not rely on extension-based declarative method constraints, or that use a single unambiguous constraint per method, are not exposed. The impact is confidentiality and integrity only (A:N), so it does not by itself cause denial of service.

The signals conflict and warrant nuanced prioritization. The CVSS 3.1 base score is 9.1 (Critical) driven by AV:N/AC:L/PR:N/UI:N with C:H/I:H, and CISA SSVC rates Technical Impact as total and Automatable as yes - all pointing to a serious, easily-scriptable authorization bypass. Counterbalancing this, the EPSS probability is only 0.02% (4th percentile), SSVC Exploitation is none, this CVE is not in CISA KEV, and no public exploit is identified at time of analysis, indicating no observed real-world exploitation yet. A critical practical limiter is that exploitation only matters when an application actually ships a specific, somewhat unusual web.xml configuration - multiple method constraints defining the same HTTP method for the same extension - so most default or simply-configured deployments are not exposed. Net assessment: treat as a high-priority patch for internet-facing Tomcat instances that rely on declarative security constraints, but the low EPSS and configuration dependency suggest this is not a mass-exploitation event; verify whether your applications use overlapping extension-based method constraints before assuming exposure.

An attacker enumerates a protected endpoint on a Tomcat application whose web.xml defines overlapping method constraints for a shared extension (for example a *.do or *.jsp mapping guarded by role-based constraints). Because Tomcat misapplies the overlapping constraint, the attacker issues an HTTP request using a method that should be denied and instead reaches the protected resource without authentication, reading or modifying data (C:H/I:H). No public POC is identified at time of analysis, but the network vector and low attack complexity make scripting straightforward if the vulnerable configuration is present.