internet-facing-service-vulnerabilitywidely-deployed-product-advisoryidentity-authentication-vulnerabilityend-of-life-software

Apache Tomcat Fixes Authorization and HTTP/2 Header Validation Flaws

Vulnerability Disclosure · 6 sources · Updated 2mo ago · First seen May 12, 2026

Apache disclosed CVE-2026-43515, an improper-authorization flaw in Tomcat’s handling of security constraints. When multiple constraints specify an HTTP method for the same extension pattern, Tomcat may enforce only the first constraint, potentially allowing intended access restrictions to be applied incorrectly. The issue affects Tomcat 9.0.0.M1–9.0.117, 10.1.0-M1–10.1.54, and 11.0.0-M1–11.0.21; MITRE also lists legacy Tomcat 7.0.0–7.0.109 and 8.5.0–8.5.100 as affected.

Apache also fixed CVE-2026-41293, a low-severity HTTP/2 request-header validation issue that can cause unexpected behavior in applications relying on Servlet API header values being specification-compliant. Organizations should upgrade to Tomcat 9.0.118, 10.1.55, or 11.0.22 or later; unsupported releases should be retired or moved to a supported fixed version. Apache had separately disclosed CVE-2026-32990, identifying an incomplete prior fix for CVE-2025-66614.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

4 events · May 12, 2026

May 12, 20266mo ago
Apache discloses CVE-2026-43513 LockOutRealm case-sensitivity flaw
Apache disclosed CVE-2026-43513, an improper case-sensitivity handling vulnerability in Tomcat's LockOutRealm component. It affects Tomcat 7.0.0–7.0.109, 8.5.0–8.5.100, 9.0.0.M1–9.0.117, 10.1.0-M1–10.1.54, and 11.0.0-M1–11.0.21; upgrades to 9.0.118, 10.1.55, or 11.0.22 remediate the issue.
CVE Record: CVE-2026-43513
May 12, 20266mo ago
Apache discloses CVE-2026-43515 security-constraint flaw
Apache disclosed moderate-severity CVE-2026-43515, an improper-authorization issue where only the first HTTP-method constraint may be enforced when multiple constraints apply to the same extension pattern. Apache recommended upgrades to Tomcat 11.0.22, 10.1.55, or 9.0.118; MITRE also listed affected Tomcat 7 and 8.5 versions.
[SECURITY] CVE-2026-43515 Apache Tomcat - Security constraints not correctly applied-Apache Mail Archives
May 12, 20266mo ago
Apache discloses CVE-2026-41293 HTTP/2 header-validation flaw
Apache disclosed low-severity CVE-2026-41293, in which HTTP/2 request headers were not properly validated and could cause unexpected application behavior. Affected Tomcat releases were advised to upgrade to 11.0.22, 10.1.55, or 9.0.118 or later.
[SECURITY] CVE-2026-41293 Apache Tomcat - HTTP/2 request headers not validated-Apache Mail Archives
Reported Apr 9, 20267mo ago
Apache discloses incomplete fix for CVE-2025-66614 in Tomcat
Apache Tomcat issued a security advisory for CVE-2026-32990, stating that the fix for CVE-2025-66614 was incomplete.
[SECURITY] CVE-2026-32990 Apache Tomcat - The fix for CVE-2025-66614 is incomplete-Apache Mail Archives

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

2 linked

Insufficient HTTP/2 Request Header Validation in Apache Tomcat (CVE-2026-41293)Apache Tomcat HTTP Method Security Constraint Bypass (CVE-2026-43515)

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

6 references tracked. Mallory keeps watching after this page renders.

Lists ApacheNews · May 12, 2026

[SECURITY] CVE-2026-41293 Apache Tomcat - HTTP/2 request headers not validated-Apache Mail ArchivesOpen source ↗

Lists ApacheNews · May 12, 2026

[SECURITY] CVE-2026-43515 Apache Tomcat - Security constraints not correctly applied-Apache Mail ArchivesOpen source ↗

Cve MitreAdvisories · May 12, 2026

CVE Record: CVE-2026-43513Open source ↗

Lists ApacheNews · May 12, 2026

[SECURITY] CVE-2026-43513 Apache Tomcat - LockOutRealm treats user names as case-sensitive-Apache Mail ArchivesOpen source ↗

Cve MitreAdvisories · May 12, 2026

CVE Record: CVE-2026-43515Open source ↗

Lists ApacheNews · Apr 9, 2026

[SECURITY] CVE-2026-32990 Apache Tomcat - The fix for CVE-2025-66614 is incomplete-Apache Mail ArchivesOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Apache Tomcat Fixes Authorization and HTTP/2 Header Validation Flaws

How this story unfolded

Apache discloses CVE-2026-43513 LockOutRealm case-sensitivity flaw

Apache discloses CVE-2026-43515 security-constraint flaw

Apache discloses CVE-2026-41293 HTTP/2 header-validation flaw

Apache discloses incomplete fix for CVE-2025-66614 in Tomcat

Related entities

Vulnerabilities

Sources

See the full picture, correlated to your attack surface.

Related stories

Apache Tomcat fixes security control bypass and multiple configuration flaws

Apache Tomcat Updates Patch 11 Flaws Enabling Access Bypass and Denial of Service

Apache Tomcat Fixes Authentication, Authorization and AJP Security Flaws

Apache Tomcat Fixes Authorization and HTTP/2 Header Validation Flaws

How this story unfolded

Apache discloses CVE-2026-43513 LockOutRealm case-sensitivity flaw

Apache discloses CVE-2026-43515 security-constraint flaw

Apache discloses CVE-2026-41293 HTTP/2 header-validation flaw

Apache discloses incomplete fix for CVE-2025-66614 in Tomcat

Related entities

Vulnerabilities

Sources

See the full picture, correlated to your attack surface.

Related stories

Apache Tomcat fixes security control bypass and multiple configuration flaws

Apache Tomcat Updates Patch 11 Flaws Enabling Access Bypass and Denial of Service

Apache Tomcat Fixes Authentication, Authorization and AJP Security Flaws