Log in Start free

Vulnerability · Published Apr 9, 2026 · Assigned by apache

CVE-2026-34500Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled

Medium 6.5

In plain English

A medium-severity improper authentication in Apache Tomcat from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.5%top 60.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:9tomcat1:9.0.117-1.el9_8ALSA-2026:26323
AlmaLinux:9tomcat-admin-webapps1:9.0.117-1.el9_8ALSA-2026:26323
AlmaLinux:9tomcat-docs-webapp1:9.0.117-1.el9_8ALSA-2026:26323
AlmaLinux:9tomcat-el-3.0-api1:9.0.117-1.el9_8ALSA-2026:26323
AlmaLinux:9tomcat-jsp-2.3-api1:9.0.117-1.el9_8ALSA-2026:26323
AlmaLinux:9tomcat-lib1:9.0.117-1.el9_8ALSA-2026:26323
AlmaLinux:9tomcat-servlet-4.0-api1:9.0.117-1.el9_8ALSA-2026:26323
AlmaLinux:9tomcat-webapps1:9.0.117-1.el9_8ALSA-2026:26323
AlmaLinux:10tomcat91:9.0.117-1.el10_2.alma.1ALSA-2026:25341
AlmaLinux:10tomcat91:9.0.117-2.el10_2.alma.1ALSA-2026:36790
AlmaLinux:10tomcat9-admin-webapps1:9.0.117-2.el10_2.alma.1ALSA-2026:36790
AlmaLinux:10tomcat9-admin-webapps1:9.0.117-1.el10_2.alma.1ALSA-2026:25341
AlmaLinux:10tomcat9-docs-webapp1:9.0.117-1.el10_2.alma.1ALSA-2026:25341
AlmaLinux:10tomcat9-docs-webapp1:9.0.117-2.el10_2.alma.1ALSA-2026:36790
AlmaLinux:10tomcat9-el-3.0-api1:9.0.117-1.el10_2.alma.1ALSA-2026:25341
AlmaLinux:10tomcat9-el-3.0-api1:9.0.117-2.el10_2.alma.1ALSA-2026:36790
AlmaLinux:10tomcat9-jsp-2.3-api1:9.0.117-2.el10_2.alma.1ALSA-2026:36790
AlmaLinux:10tomcat9-jsp-2.3-api1:9.0.117-1.el10_2.alma.1ALSA-2026:25341
AlmaLinux:10tomcat9-lib1:9.0.117-2.el10_2.alma.1ALSA-2026:36790
AlmaLinux:10tomcat9-lib1:9.0.117-1.el10_2.alma.1ALSA-2026:25341
AlmaLinux:10tomcat9-servlet-4.0-api1:9.0.117-2.el10_2.alma.1ALSA-2026:36790
AlmaLinux:10tomcat9-servlet-4.0-api1:9.0.117-1.el10_2.alma.1ALSA-2026:25341
AlmaLinux:10tomcat9-webapps1:9.0.117-2.el10_2.alma.1ALSA-2026:36790
AlmaLinux:10tomcat9-webapps1:9.0.117-1.el10_2.alma.1ALSA-2026:25341
Debian:12tomcat1010.1.55-1~deb12u1DEBIAN-CVE-2026-34500
Debian:13tomcat1010.1.55-1~deb13u1DEBIAN-CVE-2026-34500
Debian:14tomcat1010.1.54-1DEBIAN-CVE-2026-34500
Debian:13tomcat1111.0.22-1~deb13u1DEBIAN-CVE-2026-34500
Debian:14tomcat1111.0.21-1DEBIAN-CVE-2026-34500
Debian:12tomcat99.0.70-2DEBIAN-CVE-2026-34500
Debian:13tomcat99.0.70-2DEBIAN-CVE-2026-34500
Debian:14tomcat99.0.70-2DEBIAN-CVE-2026-34500
Mavenorg.apache.tomcat:tomcat-coyote-ffm11.0.21GHSA-24j9-x2wg-9qv6
Mavenorg.apache.tomcat:tomcat-coyote-ffm10.1.54GHSA-24j9-x2wg-9qv6
Mavenorg.apache.tomcat:tomcat-coyote-ffm9.0.117GHSA-24j9-x2wg-9qv6
Rocky Linux:10tomcat91:9.0.117-1.el10_2RLSA-2026:25341
Ubuntu:25.10tomcat10no fix listedUBUNTU-CVE-2026-34500
Ubuntu:26.04:LTStomcat10no fix listedUBUNTU-CVE-2026-34500
Ubuntu:25.10tomcat11no fix listedUBUNTU-CVE-2026-34500
Ubuntu:26.04:LTStomcat11no fix listedUBUNTU-CVE-2026-34500
Ubuntu:25.10tomcat9no fix listedUBUNTU-CVE-2026-34500
Ubuntu:26.04:LTStomcat9no fix listedUBUNTU-CVE-2026-34500

Affected products (as reported)

VendorProductVersions
Apache Software Foundation Apache Tomcat 11.0.0-M14 – through 11.0.2010.1.22 – through 10.1.539.0.92 – through 9.0.116

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

References