CVE-2009-0580: Apache Tomcat FORM auth username enumeration via malformed j_password

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

medium priorityThe flaw only exposes username validity with no direct compromise, but the very high EPSS score and wide Tomcat deployment base make it worth prompt remediation.

What it is

Apache Tomcat 4.1.0-4.1.39, 5.5.0-5.5.27 and 6.0.0-6.0.18 mishandle error checking in the MemoryRealm, DataSourceRealm and JDBCRealm when FORM authentication is used. A request to /j_security_check with malformed URL encoding in the j_password parameter (for example a bare % value) produces a distinguishable response that reveals whether a username exists. This is an information exposure issue that aids credential attacks rather than granting access by itself.

Impact

An attacker learns which usernames are valid on the application, enabling targeted password guessing or lockout abuse. No credentials, session or code execution are obtained directly.

Attack surface

Reachable remotely over HTTP by sending crafted requests to the FORM authentication endpoint /j_security_check; no authentication is required, and the flaw only applies to deployments configured with FORM authentication. No user interaction is needed.

Exploitation

Not listed in CISA KEV and no public exploit tag appears in the references, but EPSS is very high (0.9444, 99.8th percentile), indicating strong predicted likelihood of exploitation activity.

What to do

• Upgrade Tomcat to a release after 4.1.39, 5.5.27 or 6.0.18 that contains the vendor patches referenced in the Apache security pages.
• If immediate upgrade is not possible, avoid FORM authentication or front the login endpoint with controls that normalize and reject malformed percent-encoded parameters.
• Apply the vendor SVN patch revisions (747840, 781379, 781382) or the equivalent distribution update from your OS vendor.
• Rate-limit and monitor repeated /j_security_check requests to blunt username enumeration and follow-on guessing.

Detection

• Alert on /j_security_check requests whose j_password parameter contains malformed or incomplete percent-encoding, such as a trailing or standalone %.
• Baseline response sizes and status codes for failed logins and flag deviations that correlate with different usernames.
• Track repeated failed FORM logins from a single source across many distinct usernames, which indicates enumeration.
• Review web logs for scanning patterns against the FORM authentication endpoint outside normal user behavior.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.