CVE-2026-43512 Apache Software Foundation CVE debrief

Who should care

Defenders responsible for Apache Tomcat instances, particularly those using digest authentication, should assess exposure and prioritize upgrading to patched versions. This includes operators managing Apache Tomcat deployments, security teams responsible for vulnerability management, and platform administrators who oversee the affected versions. Accurate version tracking and verification against the affected ranges are crucial. Security teams should also

Why it matters

CVE-2026-43512 is a critical authentication bypass issue in Apache Tomcat's digest authentication. Defenders responsible for Apache Tomcat instances should assess exposure and prioritize upgrading to patched versions (11.0.22, 10.1.55, or 9.0.118) to prevent potential authentication bypass. The issue affects multiple Apache Tomcat versions, and upgrading vulnerable instances is crucial to prevent potential unauthorized access.

• Potential authentication bypass in Apache Tomcat instances using digest authentication
• Need to verify and upgrade vulnerable Apache Tomcat instances to patched versions
• Possible increased risk of unauthorized access to Apache Tomcat instances

Technical summary

CVE-2026-43512 is an authentication bypass issue in Apache Tomcat's digest authentication. The issue affects multiple Apache Tomcat versions: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, and before 7.0.0. This vulnerability allows potential authentication bypass in Apache Tomcat instances using digest authentication. Defenders should prioritize upgrading vulnerable instances to patched versions to prevent potential unauthorized access. Users are recommended to upgrade to version 11.0.22, 10.1.55, or 9.0.118, which fix the issue.

Defensive priority

Defenders should prioritize upgrading vulnerable Apache Tomcat instances to patched versions to prevent potential authentication bypass.

Recommended defensive actions

• Upgrade vulnerable Apache Tomcat instances to patched versions (11.0.22, 10.1.55, or 9.0.118)
• Review and update inventory of Apache Tomcat instances to ensure accurate version tracking
• Monitor Apache Tomcat instances for potential authentication bypass attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability and affected versions. Affected versions include Apache Tomcat 11.0.0-M1 through 11.0.21, 10.1.0-M1 through 10.1.54, 9.0.0.M1 through 9.0.117, 8.5.0 through 8.5.100, and before 7.0.0. Users should verify their instances against these ranges. The CVE Program and NVD provide additional context but do not detail specific exploits or patch implementation guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.