CVE-2011-5064: DigestAuthenticator.java in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x bef...

Security readout for executives and security teams

This vulnerability affects old Apache Tomcat versions using HTTP Digest authentication. Tomcat used a known hard-coded secret, weakening the cryptographic protection behind that authentication mechanism. The main business risk is unauthorized access to protected web applications on legacy Tomcat deployments. No source provided shows active exploitation. Exposure is most likely in legacy Tomcat deployments before 5.5.34, 6.0.33, or 7.0.12 where HTTP Digest authentication protects application routes. Systems using current Tomcat, not using Digest authentication, or already patched through vendor packages are less likely exposed. Prioritize remediation where legacy Tomcat still protects business applications with Digest authentication. The issue is old and not KEV-listed, but authentication bypass risk warrants scheduled patching and focused exposure checks. Mitigation focus: Upgrade Tomcat to at least 5.5.34, 6.0.33, or 7.0.12.; Apply downstream vendor security updates from Debian, Red Hat, or SUSE where applicable.; Identify applications relying on HTTP Digest authentication on affected Tomcat versions..

Prepared

Jun 27, 2026, 17:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.