Summary
It was discovered that Tomcat incorrectly handled digest
authentication. A remote attacker could possibly use this issue to
bypass authentication restrictions. (CVE-2026-43512)
It was discovered that Tomcat incorrectly handled case sensitivity
in LockOutRealm. A remote attacker could possibly use this issue to
bypass account lockout protections and obtain sensitive information.
(CVE-2026-43513)
It was discovered that Tomcat incorrectly handled authorization when
multiple method constraints defined the same HTTP method. A remote
attacker could possibly use this issue to bypass authorization
restrictions. (CVE-2026-43515)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | tomcat6 | 6.0.39-1ubuntu0.1+esm3 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | tomcat7 | 7.0.52-1ubuntu0.16+esm2 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | tomcat7 | 7.0.68-1ubuntu0.4+esm4 |