CVE-2012-5887: The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.3...

Security readout for executives and security teams

Some older Apache Tomcat versions could let an attacker reuse observed HTTP Digest authentication traffic to bypass intended access controls. This is not a generic internet-wide remote login flaw: the supplied description says the attacker needs to sniff valid network requests. Systems still running those old Tomcat branches with Digest authentication deserve targeted review. Exposure is most plausible on legacy Tomcat deployments using HTTP Digest authentication, especially where traffic could be observed on an untrusted network segment. Modern, upgraded, or non-Digest deployments are less likely to be affected based on the supplied sources. Treat this as a legacy exposure cleanup item, not an emergency based on the supplied evidence. Prioritize systems that are internet-facing, protect sensitive administrative functions, use Digest authentication, or sit on networks where traffic interception is plausible. Mitigation focus: Upgrade Tomcat to 5.5.36, 6.0.36, 7.0.30, or later as applicable.; Apply vendor distribution advisories for packaged Tomcat builds.; Inventory applications still using HTTP Digest authentication on legacy Tomcat..

Prepared

Jun 24, 2026, 12:04 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.