What is the CVSS score of CVE-2026-43514?

CVE-2026-43514 has a CVSS 3.1 base score of 3.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-43514?

Yes, a patch is available for CVE-2026-43514. Update the affected software to the latest version immediately.

Apache Tomcat CVE-2026-43514

EUVD-2026-29518 LOW

Observable Timing Discrepancy (CWE-208)

2026-05-12 apache

GHSA-9m89-8frq-c98c

Apache Information Disclosure Tomcat Apache Tomcat Apache Software Foundation

3.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.7 LOW

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 12:55 vuln.today

CVSS changed

May 13, 2026 - 18:22 NVD

3.7 (LOW)

CVE Published

May 12, 2026 - 15:32 nvd

UNKNOWN (no severity yet)

CVE Published

May 12, 2026 - 15:32 nvd

LOW 3.7

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 maven packages depend on org.apache.tomcat.embed:tomcat-embed-core (2 direct, 0 indirect)
2 maven packages depend on org.apache.tomcat:tomcat-catalina (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 10.1.0-M1 and other introduced versions.

DescriptionCVE.org

Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Older unsupported versions may also be affected.

Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.

AnalysisAI

Timing side-channel in Apache Tomcat's AJP secret comparison exposes the shared AJP connector secret to remote, unauthenticated attackers capable of making precise network timing measurements. The vulnerability, tracked as CWE-208 (Observable Timing Discrepancy), affects all major Tomcat branches from 7.0.0 through current releases prior to the fixed versions, and could allow an attacker to recover the AJP shared secret through repeated probing. No public exploit code exists at time of analysis, EPSS is 0.02%, and CISA SSVC rates exploitation as none - making real-world risk low despite the network-accessible attack vector.

Technical ContextAI

Apache Tomcat's AJP (Apache JServ Protocol) connector uses a shared secret to authenticate connections from a front-end web server (typically Apache httpd with mod_jk or mod_proxy_ajp). The secret comparison in affected versions is not performed in constant time, meaning the comparison function returns faster when an early byte mismatch occurs versus a late-byte mismatch or a correct match. CWE-208 captures this root cause: observable timing differences leak information about the secret's content, enabling a timing oracle attack where an adversary can statistically infer the secret one character at a time. The affected CPE is cpe:2.3:a:apache_software_foundation:apache_tomcat:*:*:*:*:*:*:*:* across branches 7.0.x, 8.5.x, 9.0.x, 10.1.x, and 11.0.x. This class of bug is well understood and fixed by replacing standard string comparison with a constant-time comparison function.

RemediationAI

Upgrade to Apache Tomcat 11.0.22, 10.1.55, or 9.0.118, which are the vendor-confirmed fixed releases per the Apache security advisory at https://lists.apache.org/thread/2k654v5cq123npfsd1b2kk1y30owqb1m. Users on the end-of-life 8.5.x or 7.0.x branches should migrate to a supported branch and apply the patch, as no fixed release exists for those branches. As a compensating control, ensure the AJP connector is bound only to localhost (address='::1' or address='127.0.0.1' in server.xml) and is not reachable from untrusted network segments - this significantly raises the bar for timing-based attacks by requiring local or adjacent network access rather than remote Internet paths. Disabling the AJP connector entirely (by removing or commenting out the AJP Connector element in server.xml) is the strongest mitigation if AJP is not required; this eliminates the attack surface with no functional trade-off for deployments using only HTTP/HTTPS connectors. Restricting AJP connector access via host-based firewall rules to permit only the known front-end proxy IP is an additional layered control.