CVE-2026-43512 is an authentication bypass vulnerability in Apache Tomcat's digest authentication implementation. The flaw allows remote attackers to bypass authentication controls, potentially gaining unauthorized access. The vulnerability affects Tomcat versions from 11.0.0 through 11.0.21, 10.1.0 through 10.1.54, 9.0.0 through 9.0.117, 8.5.0 through 8.5.100, and versions before 7.0.0. Ubuntu has released security advisories (USN-8383-1, USN-8417-1) detailing the issue and providing patched package versions. The vulnerability is marked critical due to the potential for unauthorized access. Users should upgrade to fixed versions 11.0.22, 10.1.55, or 9.0.118 and restart Tomcat to mitigate the risk.

The vulnerability allows remote attackers to bypass authentication restrictions in Apache Tomcat, potentially granting unauthorized access to protected resources. This can lead to unauthorized actions within applications relying on Tomcat's digest authentication. The issue is critical given the authentication bypass nature, which undermines access controls.

A fix is available. Users should upgrade Apache Tomcat to versions 11.0.22, 10.1.55, or 9.0.118 or later. Ubuntu users should apply the security updates provided in the relevant Ubuntu Security Notices (USN-8383-1, USN-8417-1) and restart Tomcat after updating to ensure the patches take effect. No additional mitigation steps are required beyond applying these official fixes.