This vulnerability (CVE-2026-43513) in Apache Tomcat's LockOutRealm component arises from improper handling of case sensitivity (CWE-178). Affected versions include 11.0.0-M1 through 11.0.21, 10.1.0-M1 through 10.1.54, 9.0.0.M1 through 9.0.117, 8.5.0 through 8.5.100, and 7.0.0 through 7.0.109. The issue could allow an attacker to circumvent security mechanisms relying on case-sensitive comparisons, potentially exposing sensitive information. The vulnerability has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, and high confidentiality impact. Users are advised to upgrade to fixed versions 11.0.22, 10.1.55, or 9.0.118 to remediate the issue.

The vulnerability allows an attacker to exploit improper case sensitivity handling in the LockOutRealm, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact). There is no impact on integrity or availability. The attack can be performed remotely without privileges or user interaction, increasing the risk of exploitation. However, no known exploits are reported in the wild at this time.

A fix is available. Users should upgrade affected Apache Tomcat instances to versions 11.0.22, 10.1.55, or 9.0.118 as recommended by the vendor. No other mitigation or temporary workaround is indicated. Patch status is confirmed by the vendor advisory embedded in the description.