HIGH7.5
GHSA-5mp6-jrq3-r938
Apache Tomcat: LockOutRealm treats user names as case-sensitive
Quick fix
GHSA-5mp6-jrq3-r938 — org.apache.tomcat.embed:tomcat-embed-core: upgrade to the fixed version with the command below.
# pom.xml: bump <version>9.0.118</version> for org.apache.tomcat.embed:tomcat-embed-coreDetails
Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.21, from 10.1.0-M1 through 10.1.54, from 9.0.0.M1 through 9.0.117, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Older unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.22, 10.1.55 or 9.0.118 which fix the issue.
Are you affected?
Enter the version of the package you're using.
Affected packages
Maven/org.apache.tomcat.embed:tomcat-embed-core
Introduced in:
0Fixed in: 9.0.118Fix
# pom.xml: bump <version>9.0.118</version> for org.apache.tomcat.embed:tomcat-embed-coreMaven/org.apache.tomcat.embed:tomcat-embed-core
Introduced in:
10.1.0-M1Fixed in: 10.1.55Fix
# pom.xml: bump <version>10.1.55</version> for org.apache.tomcat.embed:tomcat-embed-coreMaven/org.apache.tomcat.embed:tomcat-embed-core
Introduced in:
11.0.0-M1Fixed in: 11.0.22Fix
# pom.xml: bump <version>11.0.22</version> for org.apache.tomcat.embed:tomcat-embed-coreMaven/org.apache.tomcat:tomcat
Introduced in:
0Fixed in: 9.0.118Fix
# pom.xml: bump <version>9.0.118</version> for org.apache.tomcat:tomcatMaven/org.apache.tomcat:tomcat
Introduced in:
10.1.0-M1Fixed in: 10.1.55Fix
# pom.xml: bump <version>10.1.55</version> for org.apache.tomcat:tomcatMaven/org.apache.tomcat:tomcat
Introduced in:
11.0.0-M1Fixed in: 11.0.22Fix
# pom.xml: bump <version>11.0.22</version> for org.apache.tomcat:tomcatMaven/org.apache.tomcat:tomcat-catalina
Introduced in:
0Fixed in: 9.0.118Fix
# pom.xml: bump <version>9.0.118</version> for org.apache.tomcat:tomcat-catalinaMaven/org.apache.tomcat:tomcat-catalina
Introduced in:
10.1.0-M1Fixed in: 10.1.55Fix
# pom.xml: bump <version>10.1.55</version> for org.apache.tomcat:tomcat-catalinaMaven/org.apache.tomcat:tomcat-catalina
Introduced in:
11.0.0-M1Fixed in: 11.0.22Fix
# pom.xml: bump <version>11.0.22</version> for org.apache.tomcat:tomcat-catalinaReferences
- https://nvd.nist.gov/vuln/detail/CVE-2026-43513[ADVISORY]
- https://github.com/apache/tomcat/commit/4a90d3fa93988c447cd5bb7482f76ff70d7f15c2[WEB]
- https://github.com/apache/tomcat/commit/6dd75beb55bd42fc5f78e929596b25018cd17717[WEB]
- https://github.com/apache/tomcat/commit/83f3e51df7b87f5f6e626951c575ded1a512e8ef[WEB]
- https://github.com/apache/tomcat[PACKAGE]
- https://lists.apache.org/thread/ytjcgldshj73lcnd1sh95od5hrghwogp[WEB]
- https://tomcat.apache.org/security-10.html[WEB]
- https://tomcat.apache.org/security-11.html[WEB]
- https://tomcat.apache.org/security-9.html[WEB]
- http://www.openwall.com/lists/oss-security/2026/05/12/9[WEB]