cve-2026-43515-poc

CVE-2026-43515 — Apache Tomcat Security Constraint Bypass Exploitability verdict: confirmed exploitable. A POST request to a resource protected by a split configuration bypasses authentication entirely. The required web.xml shape is uncommon in standard deployments — see Analysis for details. Tab...

CVE-2026-24733

CVE-2026-24733 What is CVE-2026-24733? Apache Tomcat incorrectly handled an HTTP/0.9-style HEAD request under certain security-constraint configurations. CVE-2026-24733 Defensive Verifier A lightweight, dependency-free Python security verifier for CVE-2026-24733 , an Apache Tomcat HTTP/0.9 HEAD...

cve-2025-31651

CVE-2025-36701 — Apache Tomcat - Rewrite rule bypass Discoverer: gregk4sec https://github.com/gregk4sec/cve Discovery Date: 2025-02-28 Affected Vendor: Apache Affected Product: Tomcat 9.0.x / 10.1.x / 11.0.x Severity: Critical / High CWE: CWE-116 Status: Under Review / Fixed / Public ✅ / Private...

Alibaba Cloud Linux 3 : 0311: tomcat (ALINUX3-SA-2026:0311)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0311 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2024-52316: Unchecked Error Condition...

CVE-2026-80343

Improper Handling of Case Sensitivity vulnerability in Apache Camel Netty HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-netty-http security constraint compared the request path against the configured context path using a...

CVE-2026-80343 Apache Camel: Camel-Netty-HTTP Security Constraint Bypass via Case-Sensitive Context-Path Matching

Improper Handling of Case Sensitivity vulnerability in Apache Camel Netty HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-netty-http security constraint compared the request path against the configured context path using a...

CVE-2026-80343

The camel-netty-http component in Apache Camel is vulnerable to a security constraint bypass due to improper handling of case sensitivity (CWE-178 ). The vulnerability exists because the security constraint uses a case-sensitive match against the configured context path, while the request dispatc...

CVE-2026-80343 Apache Camel: Camel-Netty-HTTP Security Constraint Bypass via Case-Sensitive Context-Path Matching

Improper Handling of Case Sensitivity vulnerability in Apache Camel Netty HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-netty-http security constraint compared the request path against the configured context path using a...

EUVD-2026-104214

Improper Handling of Case Sensitivity vulnerability in Apache Camel Netty HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-netty-http security constraint compared the request path against the configured context path using a...

CVE-2026-80343: Improper Handling of Case Sensitivity

Improper Handling of Case Sensitivity vulnerability in Apache Camel Netty HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-netty-http security constraint compared the request path against the configured context path using a...

PT-2026-117339

Improper Handling of Case Sensitivity vulnerability in Apache Camel Netty HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-netty-http security constraint compared the request path against the configured context path using a...

CVE-2026-80343

CVE-2026-80343 — camel-netty-http: security-constraint case-sensitivity bypass Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the camel-netty-http security constraint compared the request path against the configured context path using a case-sensitive match, while t...

Exploit for CVE-2026-80343

CVE-2026-80343 — camel-netty-http: security-constraint case-se...

Linux Distros Unpatched Vulnerability : CVE-2026-18661

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Eclipse Jetty, across various versions of jetty-annotations, and jetty-eeN-annotations, the Jakarta Spec authoritative url-pattern rules for mixed...

CVE-2026-18659

A flaw was found in Eclipse Jetty. A remote attacker can bypass security constraints by sending HTTP requests containing substrings of configured HTTP methods when method omission rules are used. This issue allows unauthorized users to access protected resources and endpoints that should be...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the processing of url-pattern rules when both @ServletSecurity annotations and web.xml defined security-constraint are present on the same url-pattern, and the web.xml contains more than one url-pattern for a...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the processing of url-pattern rules when both @ServletSecurity annotations and web.xml defined security-constraint are present on the same url-pattern, and the web.xml contains more than one url-pattern for a...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the processing of url-pattern rules when both @ServletSecurity annotations and web.xml defined security-constraint are present on the same url-pattern, and the web.xml contains more than one url-pattern for a...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the processing of url-pattern rules when both @ServletSecurity annotations and web.xml defined security-constraint are present on the same url-pattern, and the web.xml contains more than one url-pattern for a...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the processing of url-pattern rules when both @ServletSecurity annotations and web.xml defined security-constraint are present on the same url-pattern, and the web.xml contains more than one url-pattern for a...