CVE-2009-0580: Exposure of Sensitive Information in Apache Tomcat
Summary
CVE-2009-0580: Exposure of Sensitive Information in Apache Tomcat. Affects org.apache.tomcat:tomcat across 3 version ranges.
>= 4.1.0, < 4.1.40
>= 5.0.0, < 5.5.28
>= 6.0.0, < 6.0.19
Fixed in 4.1.40, 5.5.28 or 6.0.19, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source web server and servlet container that is widely used for hosting Java-based web applications. It provides a robust and scalable platform for running Java web applications, supporting various authentication mechanisms for securing access to these applications.
Vulnerability Detail
The vulnerability identified as CVE-2009-0580 affects Apache Tomcat versions 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 when FORM authentication is used. It allows remote attackers to enumerate valid usernames by sending requests to the '/j_security_check' endpoint with malformed URL encoding of passwords. This vulnerability is due to improper error checking in the MemoryRealm, DataSourceRealm, and JDBCRealm authentication realms. An attacker can exploit this vulnerability to gather valid usernames, potentially aiding in further attacks or unauthorized access to the application.
How To Fix
Latest published version: 11.0.27 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.1.0, < 4.1.404.1.40 -
>= 5.0.0, < 5.5.285.5.28 -
>= 6.0.0, < 6.0.196.0.19
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, users can disable the FORM authentication mechanism and use alternative authentication methods until the Apache Tomcat upgrade can be performed. This can be achieved by modifying the application's configuration to use a different authentication mechanism or by implementing custom authentication logic.
Conclusion
The vulnerability identified as CVE-2009-0580 in Apache Tomcat exposes sensitive information and allows for the enumeration of valid usernames. It is crucial to upgrade to the recommended fixed versions or apply the provided workaround to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.tomcat:tomcat →
FAQ
Apache Tomcat is an open-source web server and servlet container that provides a platform for running Java-based web applications.
The vulnerability affects Apache Tomcat versions 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18.
An attacker can exploit this vulnerability by sending requests to the '/j_security_check' endpoint with malformed URL encoding of passwords, allowing them to enumerate valid usernames.
The vulnerability can potentially aid attackers in gathering valid usernames, which can be used for further attacks or unauthorized access to the application.
To mitigate this vulnerability, it is recommended to upgrade Apache Tomcat to the fixed versions mentioned earlier or disable the FORM authentication mechanism and use alternative authentication methods.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.tomcat:tomcat.
