Apache Tomcat implements an AJP connector that requires a secret for client authentication. In affected releases, the comparison of this secret uses a non‑constant‑time algorithm, creating measurable timing differences. The vulnerability is classified as CWE‑208. An attacker who can observe response times can iteratively deduce the correct secret value. With the secret, the attacker can acquire an authenticated AJP session and obtain the same privileges as the Tomcat service, potentially compromising the web application and the underlying host.

Apache Tomcat versions from 7.0.0 through 7.0.109, 8.5.0 through 8.5.100, 9.0.0.M1 through 9.0.117, 10.1.0-M1 through 10.1.54, and 11.0.0-M1 through 11.0.21 are affected. Older unsupported releases may also be vulnerable.

The CVSS score of 3.7 indicates moderate severity, and the EPSS score of < 1% suggests a very low probability of exploitation. The vulnerability is not listed in CISA KEV. Based on the description, it is inferred that the attack vector is over the network, targeting the AJP port (default 8009). Once the secret is guessed, the attacker can bypass authentication and execute commands in the context of the Tomcat service, potentially leading to full system compromise. The risk is higher when the AJP port is exposed to untrusted hosts.