Apache Tomcat up to 11.0.21 LockOutRealm case sensitivity

Summaryinfo

A vulnerability was found in Apache Tomcat up to 7.0.109/8.5.100/9.0.117/10.1.54/11.0.21. It has been classified as critical. Affected by this issue is some unknown functionality of the component LockOutRealm. This manipulation causes case sensitivity. This vulnerability is tracked as CVE-2026-43513. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Apache Tomcat up to 7.0.109/8.5.100/9.0.117/10.1.54/11.0.21. It has been declared as critical. Affected by this vulnerability is an unknown code block of the component LockOutRealm. The manipulation with an unknown input leads to a case sensitivity vulnerability. The CWE definition for the vulnerability is CWE-178. The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results. The impact remains unknown. The summary by CVE is:

Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Older unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.

It is possible to read the advisory at lists.apache.org. This vulnerability is known as CVE-2026-43513 since 05/01/2026. The exploitation appears to be easy. The attack can be launched remotely. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/20/2026).

The vulnerability scanner Nessus provides a plugin with the ID 314335 (Apache Tomcat 10.1.0.M1 < 10.1.55 multiple vulnerabilities), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 9.0.118, 10.1.55 or 11.0.22 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (314335) and CERT Bund (WID-SEC-2026-2923). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• Atlassian Bamboo
• Atlassian Bitbucket
• Atlassian Confluence
• Atlassian Crucible
• Atlassian Fisheye
• Atlassian Jira

Productinfo

Type

• Application Server Software

Vendor

• Apache

Name

• Tomcat

Version

• 7.0.109
• 8.0
• 8.1
• 8.2
• 8.3
• 8.4
• 8.5.100
• 9.0.117
• 10.1.0
• 10.1.1
• 10.1.2
• 10.1.3
• 10.1.4
• 10.1.5
• 10.1.6
• 10.1.7
• 10.1.8
• 10.1.9
• 10.1.10
• 10.1.11
• 10.1.12
• 10.1.13
• 10.1.14
• 10.1.15
• 10.1.16
• 10.1.17
• 10.1.18
• 10.1.19
• 10.1.20
• 10.1.21
• 10.1.22
• 10.1.23
• 10.1.24
• 10.1.25
• 10.1.26
• 10.1.27
• 10.1.28
• 10.1.29
• 10.1.30
• 10.1.31
• 10.1.32
• 10.1.33
• 10.1.34
• 10.1.35
• 10.1.36
• 10.1.37
• 10.1.38
• 10.1.39
• 10.1.40
• 10.1.41
• 10.1.42
• 10.1.43
• 10.1.44
• 10.1.45
• 10.1.46
• 10.1.47
• 10.1.48
• 10.1.49
• 10.1.50
• 10.1.51
• 10.1.52
• 10.1.53
• 10.1.54
• 11.0.0
• 11.0.1
• 11.0.2
• 11.0.3
• 11.0.4
• 11.0.5
• 11.0.6
• 11.0.7
• 11.0.8
• 11.0.9
• 11.0.10
• 11.0.11
• 11.0.12
• 11.0.13
• 11.0.14
• 11.0.15
• 11.0.16
• 11.0.17
• 11.0.18
• 11.0.19
• 11.0.20
• 11.0.21

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion