Skip to main content

Apache Tomcat CVE-2026-43512

| EUVDEUVD-2026-29516 CRITICAL
DEPRECATED: Authentication Bypass Issues (CWE-592)
2026-05-12 apache GHSA-h6fc-48rj-7qqh
Tomcat Authentication Bypass Apache Apache Tomcat
Critical
Disputed · 9.8 NVD
Share

Severity by source

Sources disagree (Medium–Critical)
NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
9.1 CRITICAL

Network-reachable DIGEST auth bypass needs no attacker privileges (PR:N) and grants access to protected resources (C:H/I:H), but authentication bypass does not inherently degrade availability, so A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
CRITICAL
qualitative
Red Hat
6.5 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 23, 2026 - 22:28 vuln.today
CVSS changed
May 14, 2026 - 20:22 NVD
9.8 (CRITICAL)
CVE Published
May 12, 2026 - 15:24 nvd
CRITICAL 9.8
CVE Published
May 12, 2026 - 15:24 nvd
UNKNOWN (no severity yet)

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 2 maven packages depend on org.apache.tomcat.embed:tomcat-embed-core (2 direct, 0 indirect)
  • 2 maven packages depend on org.apache.tomcat:tomcat-catalina (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 10.1.0-M1 and other introduced versions.

DescriptionCVE.org

DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from before 7.0.0. Older unsupported versions any also be affect

Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.

AnalysisAI

Authentication bypass in Apache Tomcat's DIGEST authentication implementation allows remote attackers to circumvent HTTP Digest access authentication and reach protected resources without valid credentials, affecting Tomcat 7.0.0-7.0.109, 8.5.0-8.5.100, 9.0.0.M1-9.0.117, 10.1.0-M1-10.1.54 and 11.0.0-M1-11.0.21. The NVD-published CVSS of 9.8 reflects an unauthenticated network vector with total impact, but this record is marked DEPRECATED by the CVE program and there is no public exploit identified at time of analysis, with EPSS at just 0.04% (12th percentile) and no CISA KEV listing. Impact is scoped to deployments that actually enable DIGEST authentication, which is uncommon relative to Tomcat's overall footprint.

Technical ContextAI

Apache Tomcat is a widely used open-source Java servlet container and web server implementing the Jakarta Servlet, JSP and WebSocket specifications. The flaw resides in Tomcat's implementation of HTTP Digest Access Authentication (RFC 2617/7616), a challenge-response scheme in which the client hashes credentials with a server-issued nonce rather than sending a plaintext password. The root cause is classified as CWE-592 (Authentication Bypass Issues), a broad, now-deprecated weakness class indicating that the authentication logic can be defeated - here most plausibly through mishandling of nonce, realm, or hash validation in the DIGEST authenticator - allowing a request to be accepted as authenticated when it should not be. The single CPE (cpe:2.3:a:apache_software_foundation:apache_tomcat:*) confirms the Tomcat server itself as the affected component across all supported major branches.

RemediationAI

Vendor-released patch: upgrade to Apache Tomcat 11.0.22, 10.1.55, or 9.0.118 (or later) on the corresponding branch, per the Apache advisory at https://lists.apache.org/thread/7x09x7o12solvclslw3sz0288xc8wx73; users on end-of-life 8.5.x and 7.0.x branches should migrate to a supported, fixed release since no fixed 8.5/7.0 build is cited. For managed distributions, apply the corresponding vendor errata: Red Hat RHSA-2026:13745 / RHSA-2026:16528 (https://access.redhat.com/errata/RHSA-2026:13745) and Ubuntu USN-8383-1 (https://ubuntu.com/security/notices/USN-8383-1). If patching must be deferred, the most effective compensating control is to disable DIGEST authentication and switch the affected web application's login-config auth-method away from DIGEST (for example to BASIC over TLS or FORM/client-cert), which removes the vulnerable code path entirely at the cost of changing the authentication scheme clients use; alternatively, restrict network access to the DIGEST-protected endpoints via firewall or reverse-proxy allow-listing so only trusted sources can reach them, accepting that this narrows but does not eliminate exposure. Given the record is DEPRECATED, confirm the applicable fix version with Apache before scheduling emergency change windows.

More in Tomcat

View all
CVE-2017-12617 HIGH POC
8.1 Oct 04

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
CVE-2020-1938 CRITICAL POC
9.8 Feb 24

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Rate
CVE-2023-47246 CRITICAL POC
9.8 Nov 10

In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a f
CVE-2016-8735 CRITICAL POC
9.8 Apr 06

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
CVE-2017-12615 HIGH POC
8.1 Sep 19

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. Rated high severity (CVSS 8.1), this

CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2014-0050 HIGH POC
7.5 Apr 01

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products,
CVE-2020-13935 HIGH POC
7.5 Jul 14

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to
CVE-2017-12616 HIGH
7.5 Sep 19

When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or

CVE-2020-9484 HIGH POC
7.0 May 20

When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a)
CVE-2014-0227 MEDIUM
6.4 Feb 16

java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and
CVE-2026-34486 HIGH POC
7.5 Apr 09

Missing encryption of cluster replication traffic in Apache Tomcat 11.0.20, 10.1.53, and 9.0.116 exposes sensitive sessi

Same weakness CWE-592 – DEPRECATED: Authentication Bypass Issues

View all
CVE-2018-10933 CRITICAL POC
9.1
CVE-2024-42759 MEDIUM POC
6.3
CVE-2019-3899 CRITICAL
9.8
CVE-2018-14643 CRITICAL
9.8
CVE-2018-1085 CRITICAL
9.8
CVE-2017-2684 CRITICAL
9.0
CVE-2018-10847 HIGH
8.8
CVE-2019-10201 HIGH
8.1

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Fixed
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Fixed

Share

CVE-2026-43512 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy