Authentication Bypass Vulnerability in Apache Tomcat Packages
Summary
DEBIAN-CVE-2026-43512: DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. Affects tomcat10 versions 10.1.10-1 – 10.1.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source implementation of the Java Servlet, JavaServer Pages, and Java Expression Language technologies. It is widely used for deploying Java applications and provides a robust environment for running web applications. The affected versions of Tomcat, including tomcat9, tomcat10, and tomcat11, are vulnerable to an authentication bypass issue in their digest authentication mechanism, which could allow unauthorized access to sensitive resources.
Vulnerability Detail
The vulnerability, identified as CVE-2026-43512, stems from flaws in the digest authentication process within Apache Tomcat. This issue affects multiple versions of Tomcat, including 11.0.0-M1 through 11.0.21, 10.1.0-M1 through 10.1.54, 9.0.0.M1 through 9.0.117, and 8.5.0 through 8.5.100. Older unsupported versions may also be affected. If exploited, this vulnerability could allow an attacker to bypass authentication mechanisms, potentially leading to unauthorized access to web applications and sensitive data.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable digest authentication in their Tomcat configurations until they can apply the necessary updates. This can be done by modifying the web.xml file in the Tomcat configuration directory and removing or commenting out the digest authentication settings.
Conclusion
The authentication bypass vulnerability in Apache Tomcat poses significant risks to web applications using affected versions. It is crucial for users to upgrade to the latest patched versions to mitigate these risks. Temporary workarounds can be employed, but they should not replace the need for a proper update.
See every vulnerability recorded for tomcat10 →
FAQ
CVE-2026-43512 is a vulnerability in Apache Tomcat that allows for authentication bypass through flaws in the digest authentication mechanism.
The affected versions include Apache Tomcat from 11.0.0-M1 through 11.0.21, 10.1.0-M1 through 10.1.54, 9.0.0.M1 through 9.0.117, and 8.5.0 through 8.5.100.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate upgrading is not possible, consider disabling digest authentication as a temporary workaround until you can apply the updates.
More information can be found in the official CVE database or by visiting the Apache Tomcat security advisories page.
References
Related vulnerabilities
Recent vulnerabilities recorded for tomcat10.
