Description

Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Older unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.

Remediation

References

CVE-2026-43514

Related Vulnerabilities

WordPress Improper Input Validation Vulnerability (CVE-2020-28037)

WordPress Plugin PowerPress Podcasting by Blubrry Cross-Site Scripting (6.0.4)

WordPress Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-16780)

Atlassian Jira Observable Discrepancy Vulnerability (CVE-2020-4028)

Craft CMS Authorization Bypass Through User-Controlled Key Vulnerability (CVE-2026-25497)

Severity

Low

Classification

CVE-2026-43514 CWE-208 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities