CVE-2009-0580: Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authenticatio...

Security readout for executives and security teams

CVE-2009-0580 is a user-enumeration issue in old Apache Tomcat versions using FORM authentication. An attacker could distinguish valid usernames by causing malformed password input to be handled differently. This does not directly give access, but it can improve password-guessing, phishing, or account-targeting campaigns against legacy Tomcat applications. Exposure is most likely in legacy Java web applications still running the listed Tomcat branches with FORM authentication and one of the named realms. Modern, supported Tomcat deployments are less likely affected, but embedded or vendor-bundled Tomcat copies should be checked. Treat this as a legacy exposure cleanup item with moderate urgency. It is unlikely to be a standalone breach path, but it can materially help attackers target accounts if old Tomcat authentication pages remain exposed. Mitigation focus: Upgrade Tomcat or vendor packages outside the listed vulnerable ranges using Apache or OS vendor guidance.; Inventory embedded Tomcat copies in commercial products and appliances, not only standalone servers.; Avoid exposing legacy FORM authentication endpoints directly to the internet where possible..

Prepared

Jun 28, 2026, 10:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.