Authentication bypass in Apache Tomcat digest authenticator (CVE-2026-43512)

When DIGEST authentication is configured in Apache Tomcat, any user not known to the configured Realm is authenticated if they present the password "null". This allows unauthorized users to bypass authentication controls and gain access to protected resources. Affected versions: - Apache Tomcat 11.0.0-M1 to 11.0.21 - Apache Tomcat 10.1.0-M1 to 10.1.54 - Apache Tomcat 9.0.0.M1 to 9.0.117 - older unsupported versions may also be affected We recommend updating to: 11.0.22, 10.1.55, 9.0.118. CVSS 9.8 · our assessment: act_now Reference: https://lists.apache.org/thread/7x09x7o12solvclslw3sz0288xc8wx73 Details: https://vuln.today/cve/CVE-2026-43512