This vulnerability in Apache Tomcat involves authentication bypass issues in the digest authentication implementation. It affects a wide range of versions across major Tomcat branches, including 7.0.x, 8.5.x, 9.0.x, 10.1.x, and 11.0.x. The Apache Software Foundation has addressed the issue in versions 11.0.22, 10.1.55, and 9.0.118. The vulnerability is identified as CWE-592, indicating a design or implementation flaw that allows bypassing authentication controls. No CVSS score is assigned, and no active exploitation has been reported. The vendor's advisory explicitly recommends upgrading to the fixed versions to remediate the issue.

Successful exploitation of this vulnerability could allow an attacker to bypass authentication mechanisms in affected Apache Tomcat versions, potentially gaining unauthorized access to protected resources. The exact impact depends on the deployment context and the privileges granted by the bypassed authentication. No known exploits in the wild have been reported at this time.

Users should upgrade affected Apache Tomcat installations to versions 11.0.22, 10.1.55, or 9.0.118 as recommended by the Apache Software Foundation. These versions include fixes for the authentication bypass vulnerability. No alternative mitigations or temporary fixes are indicated. Patch status is confirmed by the vendor's upgrade recommendation.