CVE-2026-43514
published 2026-05-12CVE-2026-43514: Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from…
PriorityP418low3.7CVSS 3.1
AVNACHPRNUINSUCLINAN
EPSS
0.35%
27.4th percentile
Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
Older unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tomcat | >= 10.1.0 < 10.1.55 | 10.1.55 |
| apache | tomcat | >= 11.0.0 < 11.0.22 | 11.0.22 |
| apache | tomcat | 7.0.0 – 7.0.109 | — |
| apache | tomcat | 8.5.0 – 8.5.100 | — |
| apache | tomcat | >= 9.0.0 < 9.0.118 | 9.0.118 |
| apache_software_foundation | apache_tomcat | 10.1.0-M1 – 10.1.54 | — |
| apache_software_foundation | apache_tomcat | 11.0.0-M1 – 11.0.21 | — |
| apache_software_foundation | apache_tomcat | 7.0.0 – 7.0.109 | — |
| apache_software_foundation | apache_tomcat | 8.5.0 – 8.5.100 | — |
| apache_software_foundation | apache_tomcat | 9.0.0.M1 – 9.0.117 | — |
| debian | jss | — | — |
| debian | tomcat10 | — | — |
| debian | tomcat11 | — | — |
| devspaces | server-rhel9 | — | — |
| redhat-pki_10 | jss | — | — |
CVSS provenance
nvdv3.13.7LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
vendor_redhat3.7LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-9m89-8frq-c98c: Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat
ghsa_unreviewed·2026-05-12
CVE-2026-43514 [LOW] CWE-208 GHSA-9m89-8frq-c98c: Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat
Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
Older unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.
GHSA
Apache Tomcat - AJP secret compared in non-constant time
ghsa·2026-05-12
CVE-2026-43514 [LOW] CWE-208 Apache Tomcat - AJP secret compared in non-constant time
Apache Tomcat - AJP secret compared in non-constant time
Versions Affected:
Apache Tomcat 11.0.0-M1 to 11.0.21
Apache Tomcat 10.1.0-M1 to 10.1.54
Apache Tomcat 9.0.0.M1 to 9.0.117
Older, unsupported versions may also be affected
Description:
The AJP secret was compared in non-constant time allowing an attacker on
the local network to mount a timing attack to determine the AJP secret.
Mitigation:
Users of the affected versions should apply one of the following
mitigations:
- Upgrade to Apache Tomcat 11.0.22 or later
- Upgrade to Apache Tomcat 10.1.55 or later
- Upgrade to Apache Tomcat 9.0.118 or later
Red Hat
tomcat-coyote: Apache Tomcat: Information disclosure via AJP secret timing discrepancy
vendor_redhat·2026-05-12·CVSS 3.7
CVE-2026-43514 [LOW] CWE-208 tomcat-coyote: Apache Tomcat: Information disclosure via AJP secret timing discrepancy
tomcat-coyote: Apache Tomcat: Information disclosure via AJP secret timing discrepancy
Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
Older unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.
A flaw was found in Apache Tomcat. The AJP secret was comparable in non-constant time, allowing an attacker on the local network to mount a timing attack to determine the AJP secret, which may lead to unauthorized access or other security bypasses.
Package: redhat-pki:10/jss (Red Hat Certificat
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-43514 jss: Apache Tomcat: Information disclosure via AJP secret timing discrepancy [fedora-all]
bugzilla·2026-06-09·CVSS 3.7
CVE-2026-43514 [LOW] CVE-2026-43514 jss: Apache Tomcat: Information disclosure via AJP secret timing discrepancy [fedora-all]
CVE-2026-43514 jss: Apache Tomcat: Information disclosure via AJP secret timing discrepancy [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-43514 mod_proxy_cluster: Apache Tomcat: Information disclosure via AJP secret timing discrepancy [fedora-all]
bugzilla·2026-06-09·CVSS 3.7
CVE-2026-43514 [LOW] CVE-2026-43514 mod_proxy_cluster: Apache Tomcat: Information disclosure via AJP secret timing discrepancy [fedora-all]
CVE-2026-43514 mod_proxy_cluster: Apache Tomcat: Information disclosure via AJP secret timing discrepancy [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-43514 mod_cluster: Apache Tomcat: Information disclosure via AJP secret timing discrepancy [fedora-all]
bugzilla·2026-06-09·CVSS 3.7
CVE-2026-43514 [LOW] CVE-2026-43514 mod_cluster: Apache Tomcat: Information disclosure via AJP secret timing discrepancy [fedora-all]
CVE-2026-43514 mod_cluster: Apache Tomcat: Information disclosure via AJP secret timing discrepancy [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-43514 tomcat-coyote: Apache Tomcat: Information disclosure via AJP secret timing discrepancy
bugzilla·2026-05-12·CVSS 3.7
CVE-2026-43514 [LOW] CVE-2026-43514 tomcat-coyote: Apache Tomcat: Information disclosure via AJP secret timing discrepancy
CVE-2026-43514 tomcat-coyote: Apache Tomcat: Information disclosure via AJP secret timing discrepancy
Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109.
Older unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.
2026-05-12
Published