BIT-tomcat-2026-86248

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/tomcat/BIT-tomcat-2026-86248.json

JSON Data

https://api.osv.dev/v1/vulns/BIT-tomcat-2026-86248

Aliases

CVE-2026-86248

Published

2026-10-01T09:36:34Z

Modified

2026-10-01T10:00:17Z

Summary

Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled

Details

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0 through 11.0.25, from 10.1.22 through 10.1.59, from 9.0.92 through 9.0.121.

Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.

Database specific

{
    "cpes":  [
        "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:*:*:*:*:*:maven:*:*"
    ],
    "severity":  "Critical"
}

References

Affected packages

Bitnami / tomcat

Package

Name: tomcat
Purl: pkg:bitnami/tomcat

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

9.0.92

Fixed

9.0.122

Introduced

10.1.22

Fixed

10.1.60

Introduced

11.0.0

Fixed

11.0.26

Database specific

source

"https://github.com/bitnami/vulndb/tree/main/data/tomcat/BIT-tomcat-2026-86248.json"