CVE-2026-43512

Critical

Published: 12/05/2026(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

A vulnerability in the digest authentication mechanism in Apache Tomcat allows for authentication bypass. This affects versions from 11.0.0-M1 to 11.0.21, 10.1.0-M1 to 10.1.54, 9.0.0.M1 to 9.0.117, 8.5.0 to 8.5.100, and versions before 7.0.0.

Risk Assessment

Organizations using vulnerable versions of Apache Tomcat may be exposed to unauthorized access to their systems. This could lead to serious data security breaches.

Recommendation

It is recommended to upgrade to versions 11.0.22, 10.1.55, or 9.0.118, which fix this vulnerability.

Original NVD description (English source)

DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from before 7.0.0. Older unsupported versions any also be affect Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.