CVE-2026-43514: Apache Tomcat: AJP secret compared in non-constant time
Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Older unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 11.0.22 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 10.1.55 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 9.0.118
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43514?
CVE-2026-43514 is considered a medium severity vulnerability due to its potential for timing attacks when comparing AJP secrets.
How do I fix CVE-2026-43514?
To fix CVE-2026-43514, upgrade Apache Tomcat to a version that is not affected, such as 11.0.22 or later.
What versions of Apache Tomcat are affected by CVE-2026-43514?
CVE-2026-43514 affects Apache Tomcat versions 8.5.0 to 8.5.100, 9.0.0.M1 to 9.0.117, 10.1.0-M1 to 10.1.54, and 11.0.0-M1 to 11.0.21.
Is CVE-2026-43514 an exploit that I should be concerned about?
Yes, CVE-2026-43514 can be exploited to gain unauthorized access to AJP secrets, warranting concern for applications using affected versions.
What impacts does CVE-2026-43514 have on my Apache Tomcat application?
CVE-2026-43514 can lead to information disclosure vulnerabilities that may compromise the security of your application by allowing attackers to exploit timing discrepancies.