Apache Tomcat - AJP secret compared in non-constant time

🗓️ 12 May 2026 18:30:38Reported by GitHub Advisory DatabaseType

AJP secret comparison was non-constant time, enabling local network timing attacks; upgrade Tomcat.

Reporter	Title	Published	Views	Family All 44
AstraLinux	Astra Linux - уязвимость в tomcat9	20 May 202605:53	–	astralinux
Chainguard	CVE-2026-43514 vulnerabilities	23 May 202601:17	–	cgr
Circl	CVE-2026-43514	12 May 202616:45	–	circl
CNNVD	Apache Tomcat 安全漏洞	12 May 202600:00	–	cnnvd
CVE	CVE-2026-43514	12 May 202615:32	–	cve
Cvelist	CVE-2026-43514 Apache Tomcat: AJP secret compared in non-constant time	12 May 202615:32	–	cvelist
Debian CVE	CVE-2026-43514	12 May 202615:32	–	debiancve
EUVD	EUVD-2026-29518	12 May 202618:30	–	euvd
Kaspersky	KLA91043 Multiple vulnerabilities in Apache Tomcat	10 May 202600:00	–	kaspersky
Mageia	Updated tomcat packages fix security vulnerability	15 May 202606:17	–	mageia

Vulners

Node

org.apache.tomcat tomcatRange11.0.0-M1–11.0.22maven

org.apache.tomcat tomcatRange10.1.0-M1–10.1.55maven

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-43514
lists	www.lists.apache.org/thread/2k654v5cq123npfsd1b2kk1y30owqb1m
openwall	www.openwall.com/lists/oss-security/2026/05/12/10
github	www.github.com/apache/tomcat/commit/933dcdbf2515972280002929e7e597dead2e9ffa
github	www.github.com/apache/tomcat/commit/a102a2a157868ca51d83eaf5a119ccd9976a113e
github	www.github.com/apache/tomcat/commit/d35d9d23263c8e4af561f615c960c91697ff200e
tomcat	www.tomcat.apache.org/security-10.html
tomcat	www.tomcat.apache.org/security-11.html
tomcat	www.tomcat.apache.org/security-9.html
github	www.github.com/advisories/GHSA-9m89-8frq-c98c

19 May 2026 14:28Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.13.7

EPSS0.001

SSVC