Timing Discrepancy Vulnerability in Apache Tomcat

CVE-2026-43514

What is CVE-2026-43514?

An observable timing discrepancy vulnerability exists in Apache Tomcat due to improper handling when comparing AJP secrets. This issue can lead to potential information disclosure, enabling attackers to exploit timing variations and infer sensitive information. Users are strongly encouraged to update to the patched versions (11.0.22, 10.1.55, or 9.0.118) to mitigate risks associated with this vulnerability. Older unsupported versions might also be susceptible to similar issues.

References