CVE-2026-34500

Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled

At a glance

Severity: MEDIUM 6.5
EPSS: EPSS 0.45 % · percentile 39 (2026-10-27)
State: PUBLISHED
Published: 2026-04-09
Updated: 2026-04-10
Assigner: apache
NVD status: Analyzed

Description

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue.

Scores

Version	Score	Vector	Scored by
CVSS 3.1	MEDIUM 6.5	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N	CISA-ADP
CVSS 3.1	MEDIUM 6.5	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N	NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Weaknesses (CWE)

CWE-287

Advisories

GHSA-24j9-x2wg-9qv6 — Apache Tomcat: CLIENT_CERT authentication does not fail as expected

European references

ENISA EUVD · EUVD-2026-21059
GCVE · GCVE-0-2026-34500

CERT-FR advisories

CERTFR-2026-AVI-1218 — Multiples vulnérabilités dans Apache Tomcat · cert.ssi.gouv.fr
CERTFR-2026-AVI-0958 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2026-AVI-0933 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2026-AVI-0500 — Multiples vulnérabilités dans VMware Tanzu · cert.ssi.gouv.fr
CERTFR-2026-AVI-0418 — Multiples vulnérabilités dans Apache Tomcat · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* ≥ 9.0.92 < 9.0.117
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* ≥ 10.1.22 < 10.1.54
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* ≥ 11.0.1 < 11.0.21
cpe:2.3:a:apache:tomcat:11.0.0:milestone14:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:11.0.0:milestone15:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:11.0.0:milestone16:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:11.0.0:milestone17:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:11.0.0:milestone18:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:11.0.0:milestone19:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:11.0.0:milestone20:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:11.0.0:milestone21:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:11.0.0:milestone22:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:11.0.0:milestone23:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:11.0.0:milestone24:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:11.0.0:milestone25:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:11.0.0:milestone26:*:*:*:*:*:*

Affected products

Product	Versions
Apache Software Foundation · Apache Tomcat	affected 11.0.0-M14 ≤ 11.0.20 ; affected 10.1.22 ≤ 10.1.53 ; affected 9.0.92 ≤ 9.0.116

References

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD