CVE-2011-5062: The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.3...

Security readout for executives and security teams

Older Apache Tomcat versions mishandled HTTP Digest authentication options. A remote attacker might weaken or bypass intended message-integrity protection when Digest authentication was used. The source bundle does not show active exploitation or a CVSS score. Exposure is mainly legacy Tomcat deployments using HTTP Digest Access Authentication. Modern, upgraded, or non-Digest-authenticated deployments are less likely to be affected based on the provided sources. Treat this as a legacy exposure cleanup item unless affected Digest-authenticated Tomcat is internet-facing or business-critical. Lack of KEV evidence lowers urgency, but obsolete Tomcat should not remain in production. Mitigation focus: Upgrade Tomcat beyond the fixed versions named in the CVE description.; Check OS vendor advisories for backported Tomcat security fixes.; Prioritize internet-facing systems using HTTP Digest authentication..

Prepared

Jun 27, 2026, 17:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.