Apache Tomcat 9.0.0.M1 < 9.0.118 multiple vulnerabilities

This Tenable plugin (314334) bundles seven CVEs fixed in Apache Tomcat 9.0.118, spanning versions 9.0.0.M1 through 9.0.117. The headline driver is CVE-2026-43512, a digest-authentication bypass where RealmBase.getDigest() silently stringifies a null password return as the literal "null", letting an attacker compute a valid DIGEST response for any nonexistent username. Also notable is CVE-2026-43515, a security-constraint bypass where multiple <web-resource-collection> blocks sharing the same URL pattern but declaring different HTTP methods causes Tomcat to enforce only the first method constraint. The remaining five CVEs — AJP secret timing leak (43514), LockOutRealm case-sensitivity gap (43513), WebSocket auth-header leakage (42498), HTTP/2 header validation gap (41293), and WebDAV unbounded-read DoS (41284) — are all rated Low by Apache themselves.

The vendor CRITICAL/9.8 label does not match reality. The NVD vector for CVE-2026-43512 assumes C:H/I:H/A:H with no prerequisites — but DIGEST authentication is a non-default, rarely deployed configuration that Red Hat explicitly calls *"not a common, out of the box and expected configuration."* More damning: the public PoC from covepseng/cve-2026-43512-poc demonstrates that even when digest hashes match, standard UserDatabaseRealm deployments return null from getPrincipal(), triggering a 401 regardless. Red Hat independently scored this at 6.5 Moderate, and Tenable's own VPR model rates the entire plugin at 4.9 Medium. CVE-2026-43515 is the more operationally relevant flaw — its PoC confirms a working bypass — but it requires a specific multi-constraint web.xml pattern that departs from standard servlet security idioms. When Tenable's own risk model disagrees with its own severity label, listen to the risk model.

1. Audit web.xml for DIGEST auth and multi-constraint patterns — Before patching, run a fleet-wide scan of web.xml files across your Tomcat estate. Search for <auth-method>DIGEST</auth-method> (CVE-2026-43512 prerequisite) and for <security-constraint> blocks containing multiple <web-resource-collection> elements sharing the same <url-pattern> with different <http-method> values (CVE-2026-43515 prerequisite). Any hits represent genuinely exposed instances that should be prioritized. For a MEDIUM verdict, the noisgate remediation SLA gives you 365 days to patch, with no formal mitigation SLA — but instances matching these patterns should be treated as HIGH-priority exceptions.
2. Switch DIGEST auth to FORM or delegate to SSO/reverse proxy — If any Tomcat instances use DIGEST auth, switch to FORM authentication (over TLS) or delegate authentication to an identity provider via SAML/OIDC. This eliminates CVE-2026-43512 entirely without waiting for a Tomcat upgrade. The change requires a web.xml update and service restart.
3. Consolidate security constraints to avoid multi-collection patterns — Refactor web.xml to use a single <web-resource-collection> per <security-constraint> with all HTTP methods listed together, or omit <http-method> entirely to protect all methods. This eliminates CVE-2026-43515. Test with the Go PoC from covepseng/cve-2026-43515-poc before and after.
4. Restrict AJP connector to localhost — Bind the AJP connector to address="127.0.0.1" and require a secret (secret="<strong-random>"). This mitigates CVE-2026-43514's timing attack and is a long-standing best practice. Most containerized Tomcat deployments already do this.
5. Disable WebDAV servlet if unused — Remove or comment out the webdav servlet mapping in web.xml to eliminate CVE-2026-41284's unbounded-read DoS vector. The WebDAV servlet is not enabled by default but may be present in legacy deployments.
6. Upgrade to Tomcat 9.0.118+ — The definitive fix for all seven CVEs. Per the noisgate remediation SLA for MEDIUM, deploy within 365 days. Prioritize instances where the web.xml audit (above) found DIGEST auth or multi-constraint patterns.

Run this script on each Tomcat host (or remotely via SSH/Ansible). It checks the installed Tomcat version by inspecting catalina.jar's MANIFEST.MF or the version.sh output. Requires read access to CATALINA_HOME. Invoke as: bash check_tomcat_314334.sh /opt/tomcat (pass your CATALINA_HOME path as the first argument). No root required — just read access to the Tomcat installation directory.

#!/usr/bin/env bash
# check_tomcat_314334.sh — Verify Apache Tomcat against Tenable 314334
# Checks if Tomcat 9.x is below 9.0.118 (vulnerable to 7 CVEs)
# Usage: bash check_tomcat_314334.sh /path/to/CATALINA_HOME
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -euo pipefail

CATALINA_HOME="${1:-${CATALINA_HOME:-}}"

if [[ -z "$CATALINA_HOME" ]]; then
  echo "UNKNOWN — supply CATALINA_HOME as argument or environment variable"
  exit 2
fi

# Try version.sh first
VERSION=""
if [[ -x "$CATALINA_HOME/bin/version.sh" ]]; then
  VERSION=$("$CATALINA_HOME/bin/version.sh" 2>/dev/null | grep -oP 'Server number:\s*\K[0-9]+\.[0-9]+\.[0-9]+' || true)
fi

# Fallback to catalina.jar manifest
if [[ -z "$VERSION" ]]; then
  JAR="$CATALINA_HOME/lib/catalina.jar"
  if [[ -f "$JAR" ]]; then
    VERSION=$(unzip -p "$JAR" META-INF/MANIFEST.MF 2>/dev/null | grep -oP 'Implementation-Version:\s*\K[0-9]+\.[0-9]+\.[0-9]+' || true)
  fi
fi

if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN — could not determine Tomcat version from $CATALINA_HOME"
  exit 2
fi

echo "Detected Tomcat version: $VERSION"

# Parse major.minor.patch
IFS='.' read -r MAJOR MINOR PATCH <<< "$VERSION"

# Only assess Tomcat 9.x
if [[ "$MAJOR" -ne 9 ]]; then
  echo "UNKNOWN — this check targets Tomcat 9.x; detected ${MAJOR}.x"
  echo "For Tomcat 10.x, fixed version is 10.1.55; for 11.x, fixed version is 11.0.22"
  exit 2
fi

# Vulnerable: 9.0.0 through 9.0.117
# Fixed: 9.0.118+
if [[ "$MINOR" -eq 0 && "$PATCH" -lt 118 ]]; then
  echo "VULNERABLE — Tomcat $VERSION is below 9.0.118 (Tenable 314334 / CVE-2026-43512 et al.)"
  # Check for DIGEST auth and multi-constraint patterns
  echo ""
  echo "--- Configuration Risk Check ---"
  WEBXML=$(find "$CATALINA_HOME" -name 'web.xml' -path '*/WEB-INF/*' 2>/dev/null || true)
  if [[ -n "$WEBXML" ]]; then
    DIGEST_HIT=$(grep -ril 'DIGEST' $WEBXML 2>/dev/null || true)
    if [[ -n "$DIGEST_HIT" ]]; then
      echo "WARNING: DIGEST auth found in: $DIGEST_HIT"
      echo "  -> CVE-2026-43512 is DIRECTLY APPLICABLE to this instance"
    else
      echo "OK: No DIGEST auth configured (CVE-2026-43512 not exploitable)"
    fi
  else
    echo "INFO: No WEB-INF/web.xml files found to inspect"
  fi
  exit 1
else
  echo "PATCHED — Tomcat $VERSION is >= 9.0.118"
  exit 0
fi

1. Tenable Plugin 314334
2. Apache Tomcat 9 Security Advisories
3. Red Hat CVE-2026-43512 Assessment
4. Red Hat CVE-2026-43515 Assessment
5. PoC: CVE-2026-43512 Digest Auth Bypass
6. PoC: CVE-2026-43515 Constraint Bypass
7. oss-security Disclosure: CVE-2026-43512
8. NVD: CVE-2026-43512