Executive brief
Apache Tomcat is a widely used web server and application container. A vulnerability in its AJP (Apache JServ Protocol) connector could allow an attacker on the network to potentially discover the secret key used to secure communications between the web server and the application. If successful, this could allow an attacker to bypass certain security controls or gain unauthorized access to the application.
Technical details
Apache Tomcat is vulnerable to an observable timing discrepancy (CWE-208) when validating the AJP secret. The comparison between the provided secret and the expected secret was performed using a non-constant time algorithm, where the execution time varied based on how many characters matched. An attacker with network access to the AJP port can perform a timing attack to iteratively guess and determine the correct AJP secret. This vulnerability affects multiple major versions of Tomcat, including 7.x, 8.x, 9.x, 10.x, and 11.x. The issue is resolved by switching to a constant-time comparison algorithm in versions 9.0.118, 10.1.55, and 11.0.22.
Affected products
- Apache Tomcat 11.0.0-M1 to 11.0.21, 10.1.0-M1 to 10.1.54, 9.0.0.M1 to 9.0.117, 8.5.0 to 8.5.100, 7.0.0 to 7.0.109
Timeline
- 2026-05-12: disclosed
- 2026-05-12: advisory
- 2026-05-12: patched
References
- https://lists.apache.org/thread/2k654v5cq123npfsd1b2kk1y30owqb1m
- http://www.openwall.com/lists/oss-security/2026/05/12/10
- https://github.com/apache/tomcat/commit/933dcdbf2515972280002929e7e597dead2e9ffa
- https://github.com/apache/tomcat/commit/a102a2a157868ca51d83eaf5a119ccd9976a113e
- https://github.com/apache/tomcat/commit/d35d9d23263c8e4af561f615c960c91697ff200e