CVE-2016-0762

What it actually does

The Realm implementations skip password processing when a supplied username does not exist, creating measurable timing differences that allow enumeration of valid usernames.

Why it matters to the business

Attackers can identify legitimate accounts on affected Tomcat deployments, raising the likelihood of targeted credential attacks and increasing operational exposure across web and application servers.

How an attack unfolds

An attacker repeatedly submits authentication requests using guessed or enumerated usernames and measures response timing; longer processing times indicate valid accounts because the password is only evaluated for existing users. The default LockOutRealm configuration raises the bar but does not eliminate the timing side-channel.

How to fix it

Upgrade Apache Tomcat to a version beyond the affected ranges (9.0.0.M10+, 8.5.5+, 8.0.37+, 7.0.71+, 6.0.46+) and confirm that LockOutRealm or equivalent account-lockout controls remain enabled.

How to confirm the fix worked

Compare running Tomcat version against the fixed release list; perform controlled timing tests with known-valid and known-invalid usernames to verify uniform password-processing latency.

Typical attack path

1. Issue authentication requests with candidate usernames to the Tomcat Realm endpoint
2. Record response latency for each request
3. Correlate longer latencies with usernames that exist in the backing store
4. Use confirmed usernames to launch password guessing or credential-stuffing campaigns

How to detect it

Search authentication and access logs for high volumes of login attempts that use many different usernames from the same client IP or user-agent within short time windows.

What your security team should do

• Prioritize upgrade of all Tomcat instances to patched releases
• Enable or verify LockOutRealm and account lockout policies
• Add rate-limiting and anomaly detection for authentication endpoints
• Review and rotate any credentials that may have been enumerated before patching