Bug 2556185 (CVE-2026-74048) - CVE-2026-74048 tomcat: Tomcat: Cryptographic policy bypass via FIPS activation failure
Summary: CVE-2026-74048 tomcat: Tomcat: Cryptographic policy bypass via FIPS activatio...
Keywords:
Status: NEW
Alias: CVE-2026-74048
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2558347 2558348 2558349
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-20 13:52 UTC by OSIDB Bzimport
Modified: 2026-10-21 15:48 UTC (History)
10 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-20 13:52:57 UTC 
Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration.



This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.26, from 10.1.22 through 10.1.60, from 9.0.92 through 9.0.122.



Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.
Note You need to log in before you can comment on or make changes to this bug.