CVE-2026-34500

Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled

Description

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue.

Scores

Faiblesses (CWE)

• CWE-287

Avis

• GHSA-24j9-x2wg-9qv6 — Apache Tomcat: CLIENT_CERT authentication does not fail as expected

Références européennes

• ENISA EUVD · EUVD-2026-21059
• GCVE · GCVE-0-2026-34500

Avis du CERT-FR

• CERTFR-2026-AVI-1218 — Multiples vulnérabilités dans Apache Tomcat · cert.ssi.gouv.fr
• CERTFR-2026-AVI-0958 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
• CERTFR-2026-AVI-0933 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
• CERTFR-2026-AVI-0500 — Multiples vulnérabilités dans VMware Tanzu · cert.ssi.gouv.fr
• CERTFR-2026-AVI-0418 — Multiples vulnérabilités dans Apache Tomcat · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

• cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* ≥ 9.0.92 < 9.0.117
• cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* ≥ 10.1.22 < 10.1.54
• cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* ≥ 11.0.1 < 11.0.21
• cpe:2.3:a:apache:tomcat:11.0.0:milestone14:*:*:*:*:*:*
• cpe:2.3:a:apache:tomcat:11.0.0:milestone15:*:*:*:*:*:*
• cpe:2.3:a:apache:tomcat:11.0.0:milestone16:*:*:*:*:*:*
• cpe:2.3:a:apache:tomcat:11.0.0:milestone17:*:*:*:*:*:*
• cpe:2.3:a:apache:tomcat:11.0.0:milestone18:*:*:*:*:*:*
• cpe:2.3:a:apache:tomcat:11.0.0:milestone19:*:*:*:*:*:*
• cpe:2.3:a:apache:tomcat:11.0.0:milestone20:*:*:*:*:*:*
• cpe:2.3:a:apache:tomcat:11.0.0:milestone21:*:*:*:*:*:*
• cpe:2.3:a:apache:tomcat:11.0.0:milestone22:*:*:*:*:*:*
• cpe:2.3:a:apache:tomcat:11.0.0:milestone23:*:*:*:*:*:*
• cpe:2.3:a:apache:tomcat:11.0.0:milestone24:*:*:*:*:*:*
• cpe:2.3:a:apache:tomcat:11.0.0:milestone25:*:*:*:*:*:*
• cpe:2.3:a:apache:tomcat:11.0.0:milestone26:*:*:*:*:*:*

Produits affectés

Références

• https://lists.apache.org/thread/7rcl4zdxryc8hy3htyfyxkbqpxjtfdl2
• http://www.openwall.com/lists/oss-security/2026/04/09/29

Sources