GHSA-5mp6-jrq3-r938
Apache Tomcat: LockOutRealm treats user names as case-sensitive
At a glance
- Published
- Updated
- CVE
- CVE-2026-43513
- Aliases
- BIT-tomcat-2026-43513
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description
Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Older unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.apache.tomcat.embed:tomcat-embed-core | introduced 0, fixed 9.0.118 |
| Maven · org.apache.tomcat.embed:tomcat-embed-core | introduced 10.1.0-M1, fixed 10.1.55 |
| Maven · org.apache.tomcat.embed:tomcat-embed-core | introduced 11.0.0-M1, fixed 11.0.22 |
| Maven · org.apache.tomcat:tomcat | introduced 0, fixed 9.0.118 |
| Maven · org.apache.tomcat:tomcat | introduced 10.1.0-M1, fixed 10.1.55 |
| Maven · org.apache.tomcat:tomcat | introduced 11.0.0-M1, fixed 11.0.22 |
| Maven · org.apache.tomcat:tomcat-catalina | introduced 0, fixed 9.0.118 |
| Maven · org.apache.tomcat:tomcat-catalina | introduced 10.1.0-M1, fixed 10.1.55 |
| Maven · org.apache.tomcat:tomcat-catalina | introduced 11.0.0-M1, fixed 11.0.22 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-43513 ADVISORY
- https://github.com/apache/tomcat/commit/4a90d3fa93988c447cd5bb7482f76ff70d7f15c2 WEB
- https://github.com/apache/tomcat/commit/6dd75beb55bd42fc5f78e929596b25018cd17717 WEB
- https://github.com/apache/tomcat/commit/83f3e51df7b87f5f6e626951c575ded1a512e8ef WEB
- https://github.com/apache/tomcat PACKAGE
- https://lists.apache.org/thread/ytjcgldshj73lcnd1sh95od5hrghwogp WEB
- https://tomcat.apache.org/security-10.html WEB
- https://tomcat.apache.org/security-11.html WEB
- https://tomcat.apache.org/security-9.html WEB
- http://www.openwall.com/lists/oss-security/2026/05/12/9 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |