Apache Tomcat - Digest authenticator will authenticate any unknown user

🗓️ 12 May 2026 18:30:38Reported by GitHub Advisory DatabaseType

Tomcat Digest authenticator may authenticate unknown users when the password is null.

Reporter	Title	Published	Views	Family All 52
AstraLinux	Astra Linux - уязвимость в tomcat9	20 May 202605:53	–	astralinux
Chainguard	CVE-2026-43512 vulnerabilities	20 May 202601:18	–	cgr
Circl	CVE-2026-43512	12 May 202616:25	–	circl
CNNVD	Apache Tomcat 安全漏洞	12 May 202600:00	–	cnnvd
CVE	CVE-2026-43512	12 May 202615:24	–	cve
Cvelist	CVE-2026-43512 Apache Tomcat: Digest authenticator will authenticate any unknown user	12 May 202615:24	–	cvelist
Debian CVE	CVE-2026-43512	12 May 202615:24	–	debiancve
EUVD	EUVD-2026-29516	12 May 202618:30	–	euvd
Kaspersky	KLA91043 Multiple vulnerabilities in Apache Tomcat	10 May 202600:00	–	kaspersky
Mageia	Updated tomcat packages fix security vulnerability	15 May 202606:17	–	mageia

Vulners

Node

org.apache.tomcat tomcatRange11.0.0-M1–11.0.22maven

org.apache.tomcat tomcatRange10.1.0-M1–10.1.55maven

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-43512
lists	www.lists.apache.org/thread/7x09x7o12solvclslw3sz0288xc8wx73
openwall	www.openwall.com/lists/oss-security/2026/05/12/8
github	www.github.com/apache/tomcat/commit/3d4d3fae07a6cd9c2eb193c5491001740ec64448
github	www.github.com/apache/tomcat/commit/6565a6cb6499e56fe2f34457cec99f9d1c4f39e9
github	www.github.com/apache/tomcat/commit/a99c355e8199adbfd67c9a1fffbd85b810b196cd
tomcat	www.tomcat.apache.org/security-10.html
tomcat	www.tomcat.apache.org/security-11.html
tomcat	www.tomcat.apache.org/security-9.html
github	www.github.com/advisories/GHSA-h6fc-48rj-7qqh

18 May 2026 20:38Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.19.8

EPSS0.00139

SSVC