CVE-2026-43512: Apache Tomcat Digest Authenticator Authentication Bypass Vulnerability
Summary
CVE-2026-43512: Apache Tomcat: Digest authenticator will authenticate any unknown user. Affects tomcat across 3 version ranges.
>= 9.0.0.M1, < 9.0.118
>= 10.1.0, < 10.1.55
>= 11.0.0, < 11.0.22
Fixed in 9.0.118, 10.1.55 or 11.0.22, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2026-43512 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source implementation of the Java Servlet, JavaServer Pages, and Java Expression Language technologies. It is widely used for deploying Java applications and provides a robust environment for web applications. However, certain versions of Tomcat are vulnerable to an authentication bypass issue in the digest authentication mechanism, which could allow unauthorized access to resources.
Vulnerability Detail
The vulnerability identified as CVE-2026-43512 allows an attacker to bypass authentication in Apache Tomcat's digest authenticator. This issue affects versions 11.0.0 through 11.0.21, 10.1.0 through 10.1.54, 9.0.0.M1 through 9.0.117, and 8.5.0 through 8.5.100, as well as unsupported older versions. The flaw arises from the digest authentication process, which incorrectly authenticates unknown users, potentially leading to unauthorized access to sensitive information and resources.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 9.0.0.M1, < 9.0.1189.0.118 -
>= 10.1.0, < 10.1.5510.1.55 -
>= 11.0.0, < 11.0.2211.0.22
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can disable digest authentication or implement additional access controls to restrict access to sensitive resources until the upgrade can be performed. This can be done by modifying the web.xml configuration file to remove or comment out the digest authentication settings.
Conclusion
CVE-2026-43512 represents a significant security risk for users of affected Apache Tomcat versions due to its authentication bypass capability. It is crucial for users to upgrade to the latest patched versions to mitigate this vulnerability and protect their applications from unauthorized access.
See every vulnerability recorded for tomcat →
FAQ
CVE-2026-43512 is a vulnerability in Apache Tomcat that allows unauthorized users to bypass authentication through the digest authenticator.
Affected versions include 11.0.0 to 11.0.21, 10.1.0 to 10.1.54, 9.0.0.M1 to 9.0.117, and 8.5.0 to 8.5.100, as well as older unsupported versions.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate upgrade is not possible, consider disabling digest authentication or implementing stricter access controls as a temporary measure.
More information can be found in the official Apache Tomcat security advisories and the CVE database.
Related vulnerabilities
Recent vulnerabilities recorded for tomcat.
