CVE-2011-1184: The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.3...

Security readout for executives and security teams

Older Apache Tomcat versions could accept replayed HTTP Digest authentication requests. An attacker who can observe valid network traffic may reuse captured authenticated requests to bypass intended access restrictions. This is most relevant for legacy Tomcat systems using Digest authentication on networks where traffic can be sniffed. Exposure is likely limited to legacy Tomcat deployments using HTTP Digest Access Authentication. Systems not using Digest authentication, not running affected Tomcat versions, or protected from traffic observation are less likely exposed. Treat as a legacy exposure issue with moderate urgency. Prioritize internet-facing or sensitive internal Tomcat applications using Digest authentication, especially where old platforms may have missed 2011-2012 vendor updates. Mitigation focus: Upgrade Tomcat to 5.5.34, 6.0.33, 7.0.12, or later as applicable.; Apply relevant distribution vendor updates from Debian, Red Hat, SUSE, Mandriva, or HP advisories.; Review Apache Tomcat security guidance for version-specific remediation details..

Prepared

Jun 27, 2026, 17:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.