CVE-2026-43512

What it actually does

This vulnerability is an authentication bypass in Apache Tomcat's HTTP Digest authentication handling. When a Tomcat-hosted application uses Digest authentication to protect resources, a remote unauthenticated attacker may be able to satisfy or bypass the authentication check without valid credentials, allowing access to protected application functionality. Because authentication is the control boundary for confidentiality, integrity, and availability of protected resources, successful exploitation can expose sensitive data, permit unauthorized actions as an authenticated user context, and potentially enable further application-level compromise depending on the privileges granted behind the protected endpoint.

Why it matters to the business

Organizations running affected Apache Tomcat versions with Digest authentication enabled may have protected web applications exposed to unauthenticated access. This can result in data disclosure, unauthorized business transactions, tampering with application content or configuration, service disruption, and regulatory or contractual impact if sensitive information is accessed. The vulnerability has a critical CVSS score and affects many Tomcat release lines, including legacy and unsupported versions, but it is not currently listed in CISA KEV and the provided EPSS score is low; remediation should still be prioritized because the flaw is network-exploitable, requires no credentials or user interaction, and has been public for over 90 days.

How an attack unfolds

An attacker first identifies an internet-facing or reachable Apache Tomcat application that challenges clients using HTTP Digest authentication. The attacker then sends crafted HTTP requests to a protected resource and manipulates Digest authentication fields or request sequencing in a way that triggers the vulnerable Tomcat authentication logic. If the server accepts the request without validating legitimate credentials, the attacker gains access to the protected resource as though authentication succeeded. From there, the attacker enumerates available application functions, retrieves sensitive data, invokes privileged operations exposed by the application, or uses the obtained access to pivot into additional application-specific weaknesses. Exploitation depends on Digest authentication being in use; Tomcat deployments that do not use Digest authentication for protected resources are less directly exposed to this specific issue.

How to fix it

Upgrade Apache Tomcat to a fixed release: Apache Tomcat 11.0.22 or later, 10.1.55 or later, or 9.0.118 or later. Apache Tomcat 8.5.x, 7.x, and older unsupported branches should be migrated to a supported fixed branch because the advisory recommends fixed versions only for supported lines. If immediate upgrade is not possible, disable Digest authentication where feasible, replace it with a non-vulnerable authentication mechanism, restrict access to affected applications using network controls or a reverse proxy, require VPN or identity-aware proxy access for protected endpoints, and increase logging around authentication decisions. Restart Tomcat instances after upgrade and verify that all active nodes, containers, golden images, and bundled Tomcat dependencies have been replaced, not just standalone installations.

How to confirm the fix worked

Confirm the running Tomcat version is 11.0.22 or later, 10.1.55 or later, or 9.0.118 or later. Validate using startup logs, package inventory, container image manifests, application server banners where exposed, and local version files such as `RELEASE-NOTES`, `RUNNING.txt`, or Tomcat library metadata. Review application configuration for Digest authentication usage, including `web.xml` entries with `DIGEST` auth methods and realms configured for protected paths. Perform an authenticated-access test against previously protected resources using invalid credentials and malformed Digest authentication attempts; the fixed system should consistently reject them with 401 responses and must not return protected content. For clustered or autoscaled deployments, validate every node and base image to ensure older instances are not reintroduced.

Typical attack path

1. Identify Apache Tomcat servers and hosted applications exposed over HTTP or HTTPS.
2. Probe protected URLs for `WWW-Authenticate: Digest` challenges.
3. Send crafted requests containing manipulated `Authorization: Digest` headers to protected endpoints.
4. Confirm whether protected content or authenticated functionality is returned without valid credentials.
5. Enumerate accessible application features and data exposed behind the Digest authentication boundary.
6. Perform unauthorized reads, writes, administrative actions, or application-specific follow-on attacks based on the privileges available.

How to detect it

Investigate Tomcat access logs, reverse proxy logs, WAF logs, application audit logs, and authentication/realm logs for evidence that protected Digest-authenticated resources were accessed without a normal successful login path. Focus on requests to sensitive or protected URLs where the server first issued a `WWW-Authenticate: Digest` challenge and then returned HTTP 200, 302, 403-to-200 transitions, or application-specific success responses after malformed, replayed, missing, or unusual `Authorization: Digest` headers. Look for spikes in 401 responses followed by successful access from the same source IP, user agent, or session; requests containing Digest parameters with unexpected empty values, repeated nonce values, unusual `nc` counters, abnormal `qop` values, or username/realm mismatches; and access to administrative or sensitive application paths from unfamiliar networks. Correlate web logs with application audit events to identify actions performed by accounts or principals that do not match expected login activity. If Tomcat is behind a proxy, ensure original client IP headers are preserved during analysis. There are no public threat actors or KEV ransomware associations provided for this issue, so detection should rely on behavioral evidence around Digest authentication bypass attempts rather than actor-specific indicators.

• Authorization: Digest
• WWW-Authenticate: Digest
• auth-method>DIGEST</auth-method>
• <auth-method>DIGEST</auth-method>
• qop=auth-int
• qop=auth
• nc=00000000
• /conf/tomcat-users.xml
• /WEB-INF/web.xml
• Apache-Coyote

What your security team should do

• Inventory all Apache Tomcat deployments, including embedded Tomcat in applications, containers, appliances, and developer-managed services.
• Prioritize remediation for internet-facing Tomcat applications and any application using HTTP Digest authentication.
• Upgrade to Tomcat 11.0.22+, 10.1.55+, or 9.0.118+; migrate unsupported 8.5.x, 7.x, and older deployments to a supported fixed branch.
• Temporarily disable Digest authentication or restrict network access to affected applications until upgrades are complete.
• Search access logs for unusual successful responses to protected URLs preceded by 401 Digest challenges or requests containing abnormal `Authorization: Digest` headers.
• Verify that load-balanced, containerized, and blue/green deployments are all running fixed versions after rollout.
• Add regression tests for authentication bypass around protected Digest-authenticated resources.
• Monitor vendor advisories for replacement guidance because the description indicates the record is deprecated, but the affected-version and upgrade guidance should still be treated as actionable until superseded.