Timing Discrepancy Vulnerability in Apache Tomcat Packages
Summary
DEBIAN-CVE-2026-43514: Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat. Affects tomcat10 versions 10.1.10-1 – 10.1.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is an open-source implementation of the Java Servlet, JavaServer Pages, and Java Expression Language technologies. It is widely used for deploying Java applications and provides a robust environment for running web applications. The affected versions of Tomcat include 11.0.0-M1 through 11.0.21, 10.1.0-M1 through 10.1.54, 9.0.0.M1 through 9.0.117, 8.5.0 through 8.5.100, and 7.0.0 through 7.0.109. This vulnerability arises from an observable timing discrepancy when comparing AJP secrets, which could potentially allow attackers to exploit the system.
Vulnerability Detail
The vulnerability, identified as CVE-2026-43514, is an observable timing discrepancy in the way Apache Tomcat compares AJP secrets. This flaw can lead to information leakage, allowing attackers to infer valid secrets through timing analysis. The issue affects multiple versions of Tomcat across different Debian ecosystems, making it critical for users to address it promptly to prevent unauthorized access and potential exploitation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can implement additional security layers such as firewalls or intrusion detection systems to monitor and mitigate potential attacks until the package is updated.
Conclusion
The observable timing discrepancy vulnerability in Apache Tomcat poses significant risks to users running affected versions. It is crucial to upgrade to the latest patched versions to safeguard against potential exploitation. Implementing temporary workarounds can provide additional security until the upgrade is completed.
See every vulnerability recorded for tomcat10 →
FAQ
CVE-2026-43514 is a vulnerability in Apache Tomcat that involves an observable timing discrepancy when comparing AJP secrets, potentially allowing attackers to exploit the system.
The affected versions include Apache Tomcat from 11.0.0-M1 through 11.0.21, 10.1.0-M1 through 10.1.54, 9.0.0.M1 through 9.0.117, 8.5.0 through 8.5.100, and 7.0.0 through 7.0.109.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If immediate upgrading is not possible, consider implementing additional security measures such as firewalls or intrusion detection systems to help protect your application.
More information can be found in the official CVE database and the Apache Tomcat security advisories.
References
Related vulnerabilities
Recent vulnerabilities recorded for tomcat10.
