CVE-2026-29145

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-29145", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-03-04T09:52:45.179Z", "datePublished": "2026-04-09T19:20:24.601Z", "dateUpdated": "2026-04-10T18:11:31.014Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Apache Tomcat", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "11.0.18", "status": "affected", "version": "11.0.0-M1", "versionType": "semver"}, {"lessThanOrEqual": "10.1.52", "status": "affected", "version": "10.1.0-M7", "versionType": "semver"}, {"lessThanOrEqual": "9.0.115", "status": "affected", "version": "9.0.83", "versionType": "semver"}, {"lessThanOrEqual": "8.5.100", "status": "unaffected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Apache Tomcat Native", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "1.1.34", "status": "affected", "version": "1.1.23", "versionType": "semver"}, {"lessThanOrEqual": "1.2.39", "status": "affected", "version": "1.2.0", "versionType": "semver"}, {"lessThanOrEqual": "1.3.6", "status": "affected", "version": "1.3.0", "versionType": "semver"}, {"lessThanOrEqual": "2.0.13", "status": "affected", "version": "2.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "gregk4sec (https://github.com/gregk4sec)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native.</p><p>This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13.</p><p>Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.</p>"}], "value": "CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13.\n\nUsers are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue."}], "metrics": [{"other": {"content": {"text": "moderate"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"description": "CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled", "lang": "en"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-04-09T19:20:24.601Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/yz5fxmhd2j43wgqykssdo7kltws57jfz"}], "source": {"discovery": "EXTERNAL"}, "title": "Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/04/09/23"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-04-09T23:15:49.788Z"}}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-287", "lang": "en", "description": "CWE-287 Improper Authentication"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-10T18:10:50.492750Z", "id": "CVE-2026-29145", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-10T18:11:31.014Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/04/09/23"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-04-09T23:15:49.788Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-29145", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-10T18:10:50.492750Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287 Improper Authentication"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-10T18:10:11.738Z"}}], "cna": {"title": "Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "gregk4sec (https://github.com/gregk4sec)"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Tomcat", "versions": [{"status": "affected", "version": "11.0.0-M1", "versionType": "semver", "lessThanOrEqual": "11.0.18"}, {"status": "affected", "version": "10.1.0-M7", "versionType": "semver", "lessThanOrEqual": "10.1.52"}, {"status": "affected", "version": "9.0.83", "versionType": "semver", "lessThanOrEqual": "9.0.115"}, {"status": "unaffected", "version": "0", "versionType": "semver", "lessThanOrEqual": "8.5.100"}], "defaultStatus": "unaffected"}, {"vendor": "Apache Software Foundation", "product": "Apache Tomcat Native", "versions": [{"status": "affected", "version": "1.1.23", "versionType": "semver", "lessThanOrEqual": "1.1.34"}, {"status": "affected", "version": "1.2.0", "versionType": "semver", "lessThanOrEqual": "1.2.39"}, {"status": "affected", "version": "1.3.0", "versionType": "semver", "lessThanOrEqual": "1.3.6"}, {"status": "affected", "version": "2.0.0", "versionType": "semver", "lessThanOrEqual": "2.0.13"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread/yz5fxmhd2j43wgqykssdo7kltws57jfz", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13.\n\nUsers are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.", "supportingMedia": [{"type": "text/html", "value": "<p>CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native.</p><p>This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13.</p><p>Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-04-09T19:20:24.601Z"}}}, "cveMetadata": {"cveId": "CVE-2026-29145", "state": "PUBLISHED", "dateUpdated": "2026-04-10T18:11:31.014Z", "dateReserved": "2026-03-04T09:52:45.179Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-04-09T19:20:24.601Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Apache Tomcat", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "11.0.18", "status": "affected", "version": "11.0.0-M1", "versionType": "semver"}, {"lessThanOrEqual": "10.1.52", "status": "affected", "version": "10.1.0-M7", "versionType": "semver"}, {"lessThanOrEqual": "9.0.115", "status": "affected", "version": "9.0.83", "versionType": "semver"}, {"lessThanOrEqual": "8.5.100", "status": "unaffected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Apache Tomcat Native", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "1.1.34", "status": "affected", "version": "1.1.23", "versionType": "semver"}, {"lessThanOrEqual": "1.2.39", "status": "affected", "version": "1.2.0", "versionType": "semver"}, {"lessThanOrEqual": "1.3.6", "status": "affected", "version": "1.3.0", "versionType": "semver"}, {"lessThanOrEqual": "2.0.13", "status": "affected", "version": "2.0.0", "versionType": "semver"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "matchCriteriaId": "2F4C25F3-54B7-42C3-9CEE-853D64F538B9", "versionEndExcluding": "9.0.116", "versionStartIncluding": "9.0.83", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "matchCriteriaId": "6A9752F3-66FC-41BC-BBB9-50AC9A7DBC55", "versionEndExcluding": "10.1.53", "versionStartIncluding": "10.1.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "matchCriteriaId": "1F39B82B-0E67-459D-8065-2C6EE7970D0D", "versionEndExcluding": "11.0.20", "versionStartIncluding": "11.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:-:*:*:*:*:*:*", "matchCriteriaId": "8AF99366-B85F-447F-90EF-E4F163193A78", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone10:*:*:*:*:*:*", "matchCriteriaId": "33C71AE1-B38E-4783-BAC2-3CDA7B4D9EBA", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone11:*:*:*:*:*:*", "matchCriteriaId": "F6BD4180-D3E8-42AB-96B1-3869ECF47F6C", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone12:*:*:*:*:*:*", "matchCriteriaId": "64668CCF-DBC9-442D-9E0F-FD40E1D0DDB7", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone13:*:*:*:*:*:*", "matchCriteriaId": "FC64BB57-4912-481E-AE8D-C8FCD36142BB", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone14:*:*:*:*:*:*", "matchCriteriaId": "49B43BFD-6B6C-4E6D-A9D8-308709DDFB44", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone15:*:*:*:*:*:*", "matchCriteriaId": "919C16BD-79A7-4597-8D23-2CBDED2EF615", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone16:*:*:*:*:*:*", "matchCriteriaId": "81B27C03-D626-42EC-AE4E-1E66624908E3", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone17:*:*:*:*:*:*", "matchCriteriaId": "BD81405D-81A5-4683-A355-B39C912DAD2D", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone18:*:*:*:*:*:*", "matchCriteriaId": "2DCE3576-86BC-4BB8-A5FB-1274744DFD7F", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone19:*:*:*:*:*:*", "matchCriteriaId": "5571F54A-2EAC-41B6-BDA9-7D33CFE97F70", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone20:*:*:*:*:*:*", "matchCriteriaId": "ED30E850-C475-4133-BDE3-74CB3768D787", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone7:*:*:*:*:*:*", "matchCriteriaId": "941FCF7B-FFB6-4967-95C7-BB3D32C73DAF", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone8:*:*:*:*:*:*", "matchCriteriaId": "CE1A9030-B397-4BA6-8E13-DA1503872DDB", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat:10.1.0:milestone9:*:*:*:*:*:*", "matchCriteriaId": "6284B74A-1051-40A7-9D74-380FEEEC3F88", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat_native:*:*:*:*:*:*:*:*", "matchCriteriaId": "4285FB15-C93B-498C-9DA1-E5C3364A0280", "versionEndExcluding": "1.3.7", "versionStartIncluding": "1.1.23", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat_native:*:*:*:*:*:*:*:*", "matchCriteriaId": "89778321-0002-4D5F-85DB-EAE3CB9B53CA", "versionEndExcluding": "2.0.14", "versionStartIncluding": "2.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13.\n\nUsers are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue."}, {"lang": "es", "value": "La autenticaci\u00f3n CLIENT_CERT no falla como se espera para algunos escenarios cuando el fallo suave est\u00e1 deshabilitado, vulnerabilidad en Apache Tomcat, Apache Tomcat Native.\n\nEste problema afecta a Apache Tomcat: desde 11.0.0-M1 hasta 11.0.18, desde 10.1.0-M7 hasta 10.1.52, desde 9.0.83 hasta 9.0.115; Apache Tomcat Native: desde 1.1.23 hasta 1.1.34, desde 1.2.0 hasta 1.2.39, desde 1.3.0 hasta 1.3.6, desde 2.0.0 hasta 2.0.13.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n Tomcat Native 1.3.7 o 2.0.14 y Tomcat 11.0.20, 10.1.53 y 9.0.116, que solucionan el problema."}], "id": "CVE-2026-29145", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-29145", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-10T18:10:50.492750Z", "version": "2.0.3"}}]}, "published": "2026-04-09T20:16:24.447", "references": [{"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/yz5fxmhd2j43wgqykssdo7kltws57jfz"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/04/09/23"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "Apache Tomcat: Apache Tomcat: Authentication bypass due to CLIENT_CERT soft fail misconfiguration", "id": "2457037", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457037"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-303", "details": ["A flaw was found in Apache Tomcat and Apache Tomcat Native. When CLIENT_CERT authentication is configured with \"soft fail\" disabled, the authentication process may not correctly fail in certain scenarios. This vulnerability could allow an attacker to bypass expected client certificate authentication, potentially leading to unauthorized access to protected resources."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, ensure that CLIENT_CERT authentication is configured to strictly enforce client certificate validation. Review the Apache Tomcat conf/server.xml configuration. For SSLHostConfig or Connector elements, set the clientAuth attribute to required or ensure softFail is enabled if optional client certificate authentication is desired. A restart of the Apache Tomcat service is necessary for these configuration changes to apply."}, "name": "CVE-2026-29145", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "tomcat", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "tomcat9", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "tomcat6", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "tomcat", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "pki-deps:10.6/pki-servlet-engine", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "tomcat", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "pki-servlet-engine", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "tomcat", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:5", "fix_state": "Fix deferred", "package_name": "tomcat", "product_name": "Red Hat JBoss Web Server 5"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:6", "fix_state": "Fix deferred", "package_name": "tomcat", "product_name": "Red Hat JBoss Web Server 6"}], "public_date": "2026-04-09T19:20:24Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-29145\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-29145\nhttps://lists.apache.org/thread/yz5fxmhd2j43wgqykssdo7kltws57jfz"], "statement": "This Moderate vulnerability in Apache Tomcat and Apache Tomcat Native arises when CLIENT_CERT authentication is configured with \"soft fail\" disabled. This misconfiguration can lead to an authentication bypass, potentially allowing unauthorized access to protected resources. Red Hat Enterprise Linux versions 6, 7, 8, 9, and 10, along with Red Hat JBoss Web Server 5 and 6, are affected if running Apache Tomcat with this specific configuration.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[11.0.0-M1,11.0.18]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[10.1.0-M7,10.1.52]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.0.83,9.0.115]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,8.5.100]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Apache Tomcat", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "tomcat", "vendor": "apache"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.1.23,1.1.34]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.2.0,1.2.39]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.3.0,1.3.6]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.0,2.0.13]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Apache Tomcat Native", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "tomcat_native", "vendor": "apache"}], "analysis": {"en": {"generated_at": "2026-04-14T14:37:41.843603+00:00", "value": {"mitigation_remediation": ["Apply the vendor patch by upgrading Apache Tomcat to 9.0.116, 10.1.53, or 11.0.20 and upgrading Tomcat Native to 1.3.7 or 2.0.14.", "Verify the OCSP soft\u2011fail configuration to ensure it matches the recommended default and that client certificates are fully validated.", "If an upgrade cannot be performed immediately, temporarily disable client\u2011certificate authentication or re\u2011enable OCSP soft\u2011fail until the patch is applied.", "Monitor authentication logs for abnormal activity and configure intrusion detection to flag forged certificate attempts."], "summary": {"action": "Immediate Patch", "impact": "Authentication Bypass"}, "threat_synthesis": {"affected_systems": "Affected products are Apache Tomcat versions 9.0.83\u00a0through\u00a09.0.115, 10.1.0\u2011M7\u00a0through\u00a010.1.52, and 11.0.0\u2011M1\u00a0through\u00a011.0.18. Apache Tomcat Native is vulnerable in versions 1.1.23\u00a0through\u00a01.1.34, 1.2.0\u00a0through\u00a01.2.39, 1.3.0\u00a0through\u00a01.3.6, and 2.0.0\u00a0through\u00a02.0.13. The vendor has released fixes in Tomcat 9.0.116, 10.1.53, and 11.0.20, and Tomcat Native 1.3.7 and 2.0.14.", "description_and_impact": "The issue lies in OCSP handling for client\u2011certificate authentication in Apache Tomcat and its native library. When OCSP soft\u2011fail is disabled, the validation routine may allow certain certificates that should fail, causing the authentication process to succeed even though the certificate is not trusted. This flaw effectively bypasses client\u2011side authentication, enabling an attacker to present a forged or expired certificate and gain authorized access to protected applications. The result can be disclosure of confidential data, modification of data, or denial of services that rely on proper client authentication.", "risk_and_exploitability": "The CVSS score is 9.1, indicating high severity. EPSS is under 1\u202f%, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would likely occur over a publicly reachable network where the server is configured for client\u2011certificate authentication with OCSP soft\u2011fail disabled; an attacker could craft a request with a manipulated certificate chain to trigger the bypass. Because the flaw is purely in verification logic, no additional privileges are required beyond the ability to send a request to the affected server."}}}}, "created": "2026-04-10T08:38:56.486550+00:00", "updated": "2026-04-14T16:36:52.537376+00:00", "vendors": ["apache", "apache$PRODUCT$tomcat", "apache$PRODUCT$tomcat_native"]}