[SECURITY] CVE-2026-43513 Apache Tomcat - LockOutRealm treats user names as case-sensitive
Mark Thomas <[email protected]> Tue, 12 May 2026 16:06:47 +0100
| Newsgroups | gmane.comp.jakarta.tomcat.user,gmane.comp.apache.maven.announce,gmane.comp.apache.maven.announce,gmane.text.xml.xalan.devel |
|---|---|
| Message-ID | <[email protected]> |
CVE-2026-43513 Apache Tomcat - LockOutRealm treats user names as case-sensitive Severity: Low Vendor: The Apache Software Foundation Versions Affected: Apache Tomcat 11.0.0-M1 to 11.0.21 Apache Tomcat 10.1.0-M1 to 10.1.54 Apache Tomcat 9.0.0.M1 to 9.0.117 Older, unsupported versions may also be affected Description: The LockOut Realm treated user names as case sensitive meaning that, for Realms where the user name was case insensitive, the LockOut Realm was not as effective at blocking brute force attacks against a user's password. Mitigation: Users of the affected versions should apply one of the following mitigations: - Upgrade to Apache Tomcat 11.0.22 or later - Upgrade to Apache Tomcat 10.1.55 or later - Upgrade to Apache Tomcat 9.0.118 or later History: 2026-05-12 Original advisory References: [1] https://tomcat.apache.org/security-11.html [2] https://tomcat.apache.org/security-10.html [3] https://tomcat.apache.org/security-9.html