CVE-2026-43514
tomcat: Apache Tomcat: Information disclosure via AJP secret timing discrepancy
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · May 13, 2026
Updated · September 26, 2026
Description
A flaw was found in Apache Tomcat. The AJP secret was comparable in non-constant time, allowing an attacker on the local network to mount a timing attack to determine the AJP secret, which may lead to unauthorized access or other security bypasses.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 3.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE-208 · Observable Timing Discrepancy