Database Management

Why SolarWinds Database Performance Analyzer (DPA) is not affected by CVEs found in Apache Tomcat 10.1.0-M1 to 10.1.54

This article explains why SolarWinds Database Performance Analyzer (DPA) is not affected by CVEs found in Tomcat 10.1.0-M1 to 10.1.5[CC1.1][ZJ1.2]4 including CVE-2026-34487, CVE-2026-25854, CVE-2026-34483, CVE-2026-29146, CVE-2026-41284, CVE-2026-34500, CVE-2026-29145, CVE-2026-43513, CVE-2026-42498, CVE-2026-43515, CVE-2026-43512, CVE-2026-41293, CVE-2026-43514.

First published date

6/17/2026 6:29 PM

Last published date

6/17/2026 6:29 PM

Overview

In 2026, the National Institute of Standards and Technology (NIST) published security bulletins for the following vulnerabilities relating to Apache Tomcat.

Product section

Database Performance Analyzer

Cause

CVE-2026-34487 is an insertion of sensitive information into log file vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token.

CVE-2026-25854 is an occasional URL redirection to untrusted site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve.

CVE-2026-34483 is an improper encoding or escaping of output vulnerability in the JsonAccessLogValve component of Apache Tomcat.

CVE-2026-29146 is a padding Oracle vulnerability in Apache Tomcat EncryptInterceptor with default configuration.

CVE-2026-41284 is an allocation of resources without limits or throttling vulnerability in Apache Tomcat.

CVE-2026-34500 is a vulnerability wherein CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat.

CVE-2026-29145 is a vulnerability wherein CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native.

CVE-2026-43513 is an improper handling of case sensitivity vulnerability in LockOutRealm in Apache Tomcat.

CVE-2026-42498 is the exposure of the HTTP authentication header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat.

CVE-2026-43515 is an improper authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat.

CVE-2026-43512 is an authentication bypass issues vulnerability in digest authentication in Apache Tomcat.

CVE-2026-41293 is an improper input validation vulnerability in Apache Tomcat.

CVE-2026-43514 is an observable timing discrepancy vulnerability when comparing AJP secret in Apache Tomcat.

Resolution

SolarWinds Database Performance Analyzer (DPA) is not affected by any of the vulnerabilities listed in this KB for the following reasons:

CVE-2026-34487 - DPA is not affected by this vulnerability as the vulnerable component is not present in DPA.

CVE-2026-25854 - DPA is not affected by this vulnerability as the vulnerable component (LoadBalancerDrainingValve) is not present in DPA.

CVE-2026-34483 - DPA is not affected by this vulnerability as the vulnerable component (JsonAccessLogValve) is not present in DPA.

CVE-2026-29146 - DPA is not affected by this vulnerability as the vulnerable component (EncryptInterceptor) is not present in DPA.

CVE-2026-41284 - DPA is not affected by this vulnerability as vulnerable component (WebDAV LOCK component) is not present in DPA.

CVE-2026-34500 - DPA is not affected by this vulnerability. DPA's HTTPS connector does not use CLIENT_CERT as an authentication mechanism.

CVE-2026-29145 - DPA is not affected by this vulnerability. DPA's HTTPS connector does not use CLIENT_CERT as an authentication mechanism.

CVE-2026-43513 - DPA is not affected by this vulnerability. The vulnerability is only exploitable when Tomcat LockOutRealm is configured and active. DPA does not configure any Tomcat Realm.

CVE-2026-42498 - DPA is not affected by this vulnerability because DPA never uses Tomcat WebSocket client to connect outbound.

CVE-2026-43515 - DPA is not affected by this vulnerability because DPA's security constraints use completely non-overlapping HTTP method sets, which does not trigger the condition mentioned by this CVE.

CVE-2026-43512 - DPA is not affected by this vulnerability. The vulnerability requires Tomcat's DigestAuthenticator to be active. DPA bypasses Tomcat's authentication layer entirely and uses Spring Security as its authentication framework. No Digest auth configuration exists anywhere in the DPA codebase or Tomcat configuration files.

CVE-2026-41293 - DPA is not affected by this vulnerability because HTTP\2 connector is not enabled in DPA.

CVE-2026-43514 - DPA is not affected by this vulnerability. The vulnerability requires the AJP connector to be active with a requiredSecret configured. DPA does not configure an AJP connector anywhere — its Tomcat setup uses only HTTP and HTTPS connectors. The vulnerable timing comparison code in Tomcat AJP handler is never invoked.

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third-party content at your own risk, and you will be solely responsible for the incorporation of the same if any.