Loading vulnerability…
Apache Tomcat AJP Secret Disclosure via Timing Discrepancy
CVE-2026-43514 is an observable timing discrepancy in Apache Tomcat's AJP secret comparison. The comparison is not performed in constant time, potentially allowing an attacker to infer the configured secret through timing measurements. Affected versions are 11.0.0-M1 through 11.0.21, 10.1.0-M1 through 10.1.54, 9.0.0.M1 through 9.0.117, 8.5.0 through 8.5.100, and 7.0.0 through 7.0.109. Older unsupported versions may also be affected. The vulnerability can disclose information about the AJP secret and undermine the connector's shared-secret protection.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation may disclose the AJP shared secret through a timing side channel. Recovery of the secret could allow an attacker with access to the connector to satisfy its shared-secret check. The CVE-specific assessment rates the issue Low, with limited confidentiality impact and no direct integrity or availability impact. Code execution, application-level authentication bypass, and denial of service are not established consequences of this vulnerability.
If you can’t patch tonight, do this now.
If AJP is unnecessary, disable the connector. Otherwise, restrict connector access to trusted front-end servers using network filtering and segmentation, preventing untrusted systems from submitting requests and measuring responses. These exposure-reduction measures do not correct the timing discrepancy and are not substitutes for upgrading.
Patch, then assume compromise.
Upgrade Apache Tomcat to 11.0.22 or later, 10.1.55 or later, or 9.0.118 or later within the corresponding supported release branch. Migrate affected Tomcat 7.0 and 8.5 installations to a supported, fixed branch. For distribution-packaged or embedded Tomcat deployments, install the vendor update that explicitly addresses CVE-2026-43514; vendor backports may retain an older upstream version number.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
22 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.