CVE-2026-43514: Apache Tomcat timing discrepancy in AJP secret comparison

CVE-2026-43514 · Severity: low · CVSS 3.7 · Published 2026-05-12

Apache Tomcat is a widely used web server and application container. A vulnerability in its AJP (Apache JServ Protocol) connector could allow an attacker on the network to potentially discover the secret key used to secure communications between the web server and the application. If successful, this could allow an attacker to bypass certain security controls or gain unauthorized access to the application.

Technologies: Apache Tomcat, org.apache.tomcat:tomcat (Maven), org.apache.tomcat:tomcat-catalina (Maven), org.apache.tomcat.embed:tomcat-embed-core (Maven). Vendors: Apache, Maven.

Quick answers

Is CVE-2026-43514 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-43514 being exploited in the wild.
How severe is CVE-2026-43514?
Low severity, with a CVSS score of 3.7, published 12 May 2026.
Which products and versions are affected?
Apache Tomcat 11.0.0-M1 to 11.0.21, 10.1.0-M1 to 10.1.54, 9.0.0.M1 to 9.0.117, 8.5.0 to 8.5.100, 7.0.0 to 7.0.109; org.apache.tomcat:tomcat (Maven) ECOSYSTEM:introduced=0,fixed=9.0.118; org.apache.tomcat:tomcat-catalina (Maven) ECOSYSTEM:introduced=0,fixed=9.0.118; org.apache.tomcat.embed:tomcat-embed-core (Maven) ECOSYSTEM:introduced=0,fixed=9.0.118.
Is there a fix for CVE-2026-43514?
Yes. org.apache.tomcat:tomcat (Maven): upgrade to 9.0.118 or later; org.apache.tomcat:tomcat-catalina (Maven): upgrade to 9.0.118 or later; org.apache.tomcat.embed:tomcat-embed-core (Maven): upgrade to 9.0.118 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-43514 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-43514?
Check whether you run Apache Tomcat, org.apache.tomcat:tomcat (Maven), org.apache.tomcat:tomcat-catalina (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.tomcat:tomcat (Maven): upgrade to 9.0.118 or later
    # set org.apache.tomcat:tomcat to 9.0.118 in your pom.xml or build.gradle
  • org.apache.tomcat:tomcat-catalina (Maven): upgrade to 9.0.118 or later
    # set org.apache.tomcat:tomcat-catalina to 9.0.118 in your pom.xml or build.gradle
  • org.apache.tomcat.embed:tomcat-embed-core (Maven): upgrade to 9.0.118 or later
    # set org.apache.tomcat.embed:tomcat-embed-core to 9.0.118 in your pom.xml or build.gradle

Technical details

Apache Tomcat is vulnerable to an observable timing discrepancy (CWE-208) when validating the AJP secret. The comparison between the provided secret and the expected secret was performed using a non-constant time algorithm, where the execution time varied based on how many characters matched. An attacker with network access to the AJP port can perform a timing attack to iteratively guess and determine the correct AJP secret. This vulnerability affects multiple major versions of Tomcat, including 7.x, 8.x, 9.x, 10.x, and 11.x. The issue is resolved by switching to a constant-time comparison algorithm in versions 9.0.118, 10.1.55, and 11.0.22.

Affected products

  • Apache Tomcat 11.0.0-M1 to 11.0.21, 10.1.0-M1 to 10.1.54, 9.0.0.M1 to 9.0.117, 8.5.0 to 8.5.100, 7.0.0 to 7.0.109

Identifiers

  • CVE-2026-43514
  • GHSA-9m89-8frq-c98c

Timeline

  • 2026-05-12: disclosed
  • 2026-05-12: advisory
  • 2026-05-12: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.