Skip to main content

Apache Tomcat CVE-2026-43513

| EUVDEUVD-2026-29517 HIGH
Improper Handling of Case Sensitivity (CWE-178)
2026-05-12 apache GHSA-5mp6-jrq3-r938
Apache Information Disclosure Red Hat Tomcat Apache Tomcat Apache Software Foundation
7.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vuln.today AI
5.3 MEDIUM

Network-reachable login with no auth or interaction (AV:N/AC:L/PR:N/UI:N), but leakage is limited account-state info, so C:L not C:H, aligning with SSVC 'partial'; no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
5.3 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

4
Analysis Generated
Jul 23, 2026 - 22:26 vuln.today
CVSS changed
May 14, 2026 - 20:22 NVD
7.5 (HIGH)
CVE Published
May 12, 2026 - 15:26 nvd
HIGH 7.5
CVE Published
May 12, 2026 - 15:26 nvd
UNKNOWN (no severity yet)

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 2 maven packages depend on org.apache.tomcat.embed:tomcat-embed-core (2 direct, 0 indirect)
  • 2 maven packages depend on org.apache.tomcat:tomcat-catalina (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 10.1.0-M1 and other introduced versions.

DescriptionCVE.org

Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Older unsupported versions may also be affected.

Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.

AnalysisAI

Information disclosure in Apache Tomcat's LockOutRealm component allows remote attackers to bypass account-lockout tracking because usernames are compared with inconsistent case sensitivity (CWE-178), enabling authentication-related information leakage across Tomcat 7.0.0-7.0.109, 8.5.0-8.5.100, 9.0.0.M1-9.0.117, 10.1.0-M1-10.1.54 and 11.0.0-M1-11.0.21. The CVSS 3.1 vector (7.5, C:H only) scopes the impact to confidentiality with no integrity or availability effect, consistent with the 'Information Disclosure' tagging. There is no public exploit identified at time of analysis, EPSS is negligible (0.02%, 5th percentile), and CISA SSVC records exploitation as none.

Technical ContextAI

LockOutRealm is a Tomcat Realm wrapper that sits in front of an underlying realm (JDBCRealm, DataSourceRealm, JNDIRealm, UserDatabaseRealm, etc.) and counts failed authentication attempts per username to throttle brute-force login attacks by temporarily locking accounts after a configurable number of failures. The root cause is CWE-178 (Improper Handling of Case Sensitivity): the LockOutRealm failure-tracking keys treat usernames in a case-inconsistent manner relative to how the wrapped realm authenticates them, so 'admin', 'Admin' and 'ADMIN' can be handled as distinct or merged entries depending on the path. The single CPE, cpe:2.3:a:apache_software_foundation:apache_tomcat, confirms the vanilla Apache Tomcat servlet container as the affected product across all currently maintained (and older, unsupported) release lines.

RemediationAI

Vendor-released patch: upgrade to Apache Tomcat 11.0.22, 10.1.55, or 9.0.118, which fix the issue per the Apache advisory (https://lists.apache.org/thread/ytjcgldshj73lcnd1sh95od5hrghwogp). The 8.5.x and 7.0.x branches are end-of-life and no fixed release is named for them, so operators on those lines should migrate to a supported branch; users of distribution packages should apply the corresponding fixed builds from Ubuntu (USN-8383-1) or SUSE as they land. If immediate patching is not possible, reduce exposure by enforcing correct-case credential entry and username normalization at the wrapped realm level and restricting network reachability of authenticated endpoints (for example, placing the manager/host-manager and login-protected apps behind a reverse proxy or IP allowlist); note these are partial compensating controls that do not remove the underlying case-handling flaw and may inconvenience legitimate users.

More in Tomcat

View all
CVE-2017-12617 HIGH POC
8.1 Oct 04

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
CVE-2020-1938 CRITICAL POC
9.8 Feb 24

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Rate
CVE-2023-47246 CRITICAL POC
9.8 Nov 10

In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a f
CVE-2016-8735 CRITICAL POC
9.8 Apr 06

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
CVE-2017-12615 HIGH POC
8.1 Sep 19

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. Rated high severity (CVSS 8.1), this

CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2014-0050 HIGH POC
7.5 Apr 01

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products,
CVE-2020-13935 HIGH POC
7.5 Jul 14

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to
CVE-2017-12616 HIGH
7.5 Sep 19

When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or

CVE-2020-9484 HIGH POC
7.0 May 20

When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a)
CVE-2014-0227 MEDIUM
6.4 Feb 16

java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and
CVE-2026-34486 HIGH POC
7.5 Apr 09

Missing encryption of cluster replication traffic in Apache Tomcat 11.0.20, 10.1.53, and 9.0.116 exposes sensitive sessi

Same weakness CWE-178 – Improper Handling of Case Sensitivity

View all
CVE-2020-12812 CRITICAL
9.8
CVE-2025-27636 MEDIUM POC
5.6
CVE-2021-24347 HIGH POC
8.8
CVE-2024-5699 CRITICAL POC
9.8
CVE-2023-3545 CRITICAL POC
9.8
CVE-2018-9845 CRITICAL POC
9.8
CVE-2026-53595 CRITICAL POC
9.4
CVE-2026-27588 CRITICAL POC
9.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Fixed
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Fixed

Share

CVE-2026-43513 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy