Bug 2457043 (CVE-2026-34500)

Summary:	CVE-2026-34500 Apache Tomcat: Apache Tomcat: Authentication bypass via client certificate misconfiguration
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	csutherl, dsoumis, jclere, pjindal, plodge, rhel-process-autobot, rmaucher, szappis, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Apache Tomcat where OCSP-based certificate validation may incorrectly soft-fail during CLIENT_CERT authentication, even when soft-fail is disabled, under certain FFM-related execution paths. This can result in client certificates being accepted despite failed or unverifiable revocation checks, weakening certificate validation in specific mTLS configurations.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2457234
Bug Blocks:

Description OSIDB Bzimport 2026-04-09 20:02:46 UTC

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue.

Comment 3 errata-xmlrpc 2026-05-26 12:55:53 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Web Server 6.2.3

Via RHSA-2026:20406 https://access.redhat.com/errata/RHSA-2026:20406

Comment 4 errata-xmlrpc 2026-05-26 12:56:41 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Web Server 6.2 on RHEL 10
  Red Hat JBoss Web Server 6.2 on RHEL 8
  Red Hat JBoss Web Server 6.2 on RHEL 9

Via RHSA-2026:20405 https://access.redhat.com/errata/RHSA-2026:20405