Homepage

Incorrect Behavior Order: Authorization Before Parsing and Canonicalization The advisory has been revoked - it doesn't affect any version of package tomcat9-servlet-4.0-api  (opens in a new tab)

Threat Intelligence

EPSS
1.22% (68th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-TOMCAT9SERVLET40API-18671533
  • published12 Aug 2026
  • disclosed12 May 2026
Report a new vulnerability Found a mistake?

Introduced: 12 May 2026

CVE-2026-43515  (opens in a new tab)
CWE-551  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream tomcat9-servlet-4.0-api package and not the tomcat9-servlet-4.0-api package as distributed by RHEL.

Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.

Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.