CVE-2026-43512

The error classified as CWE-592 (Authentication Bypass Issues) concerns the implementation of digest authentication in Apache Tomcat. A remote unauthenticated attacker can exploit the vulnerability over the network without user interaction and without meeting any additional conditions (vector AV:N/AC:L/PR:N/UI:N). The detailed technical mechanism has not been disclosed in the public description — however, it concerns irregularities in the handling of the digest authentication process.

An attacker can gain unauthorized access to resources protected by digest authentication mechanism, resulting in violation of confidentiality, integrity and availability of data (CVSS rating C:H/I:H/A:H).

Apache Tomcat should be immediately updated to version 11.0.22, 10.1.55 or 9.0.118, which contain the patch. For branches 8.5.x and 7.x, the manufacturer has not indicated patched versions — migration to a supported branch is recommended. As a temporary workaround, consider disabling the digest authentication mechanism or replacing it with another authentication method.

Apache Tomcat in versions: 11.0.0-M1 to 11.0.21, 10.1.0-M1 to 10.1.54, 9.0.0.M1 to 9.0.117, 8.5.0 to 8.5.100 and versions older than 7.0.0 (including older, unsupported versions of the 7.x and earlier branches)