CVE-2026-34500
Fixed in a distro release EPSS <1%CVSS 6.5
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue.
Products: Apache Software Foundation Apache Tomcat
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.apache.tomcat:tomcat-coyote-ffm | 9.0.117 |
| Maven | org.apache.tomcat:tomcat-coyote-ffm | 10.1.54 |
| Maven | org.apache.tomcat:tomcat-coyote-ffm | 11.0.21 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | camunda-8.8 | 8.8.22-r0 |
| Chainguard | camunda-zeebe-8.6 | 8.6.39-r0 |
| Chainguard | camunda-zeebe-8.7 | 8.7.27-r0 |
| Chainguard | camunda-zeebe-8.8 | 8.8.22-r0 |
| Chainguard | kayenta-2025.0 | 2025.0.8-r11 |
| Chainguard | kayenta-2025.1 | 2025.1.6-r9 |
| Chainguard | kayenta-2025.2 | 2025.2.4-r5 |
| Chainguard | kayenta-2025.4 | 2025.4.3-r6 |
| Chainguard | kayenta-2026.0 | 2026.0.2-r6 |
| Chainguard | kayenta-fips-2025.0 | 2025.0.8-r13 |
| Chainguard | kayenta-fips-2025.1 | 2025.1.6-r10 |
| Chainguard | kayenta-fips-2025.2 | 2025.2.4-r6 |
| Chainguard | kayenta-fips-2025.4 | 2025.4.3-r7 |
| Chainguard | kayenta-fips-2026.0 | 2026.0.2-r7 |
| Chainguard | nacos | 3.2.0-r6 |
| Chainguard | nacos-docker | 3.2.0-r2 |
| Chainguard | ontop | 5.5.0-r8 |
| Chainguard | ontop-fips | 5.5.0-r4 |
| Chainguard | thingsboard-tb-mqtt-transport | 4.3.1.1-r11 |
| Chainguard | thingsboard-tb-node | 4.3.1.1-r11 |
| Debian 12 | tomcat10 | 10.1.55-1~deb12u1 |
| Debian 12 | tomcat9 | 9.0.70-2 |
| Debian 13 | tomcat10 | 10.1.55-1~deb13u1 |
| Debian 13 | tomcat11 | 11.0.22-1~deb13u1 |
| Debian 13 | tomcat9 | 9.0.70-2 |
| Debian 14 | tomcat10 | 10.1.54-1 |
| Debian 14 | tomcat11 | 11.0.21-1 |
| Debian 14 | tomcat9 | 9.0.70-2 |
| Red Hat Enterprise Linux 9 | tomcat | 1:9.0.117-1.el9_8 |
| Red Hat Enterprise Linux 9 | tomcat-admin-webapps | 1:9.0.117-1.el9_8 |
| Red Hat Enterprise Linux 9 | tomcat-docs-webapp | 1:9.0.117-1.el9_8 |
| Red Hat Enterprise Linux 9 | tomcat-el-3.0-api | 1:9.0.117-1.el9_8 |
| Red Hat Enterprise Linux 9 | tomcat-jsp-2.3-api | 1:9.0.117-1.el9_8 |
| Red Hat Enterprise Linux 9 | tomcat-lib | 1:9.0.117-1.el9_8 |
| Red Hat Enterprise Linux 9 | tomcat-servlet-4.0-api | 1:9.0.117-1.el9_8 |
| Red Hat Enterprise Linux 9 | tomcat-webapps | 1:9.0.117-1.el9_8 |
| Red Hat jboss enterprise web server 6.2 | jws6-tomcat | 0:10.1.49-13.redhat_00011.1.el8jws |
| Red Hat jboss enterprise web server 6.2 | jws6-tomcat | 0:10.1.49-13.redhat_00011.1.el10jws |
| Red Hat jboss enterprise web server 6.2 | jws6-tomcat | 0:10.1.49-13.redhat_00011.1.el9jws |
| Red Hat jboss enterprise web server 6.2 | jws6-tomcat-admin-webapps | 0:10.1.49-13.redhat_00011.1.el10jws |
| Red Hat jboss enterprise web server 6.2 | jws6-tomcat-admin-webapps | 0:10.1.49-13.redhat_00011.1.el9jws |
| Red Hat jboss enterprise web server 6.2 | jws6-tomcat-admin-webapps | 0:10.1.49-13.redhat_00011.1.el8jws |
| Red Hat jboss enterprise web server 6.2 | jws6-tomcat-docs-webapp | 0:10.1.49-13.redhat_00011.1.el10jws |
| Red Hat jboss enterprise web server 6.2 | jws6-tomcat-docs-webapp | 0:10.1.49-13.redhat_00011.1.el9jws |
| Red Hat jboss enterprise web server 6.2 | jws6-tomcat-docs-webapp | 0:10.1.49-13.redhat_00011.1.el8jws |
| Red Hat jboss enterprise web server 6.2 | jws6-tomcat-el-5.0-api | 0:10.1.49-13.redhat_00011.1.el9jws |
| Red Hat jboss enterprise web server 6.2 | jws6-tomcat-el-5.0-api | 0:10.1.49-13.redhat_00011.1.el8jws |
| Red Hat jboss enterprise web server 6.2 | jws6-tomcat-el-5.0-api | 0:10.1.49-13.redhat_00011.1.el10jws |
| Red Hat jboss enterprise web server 6.2 | jws6-tomcat-javadoc | 0:10.1.49-13.redhat_00011.1.el9jws |
| Red Hat jboss enterprise web server 6.2 | jws6-tomcat-javadoc | 0:10.1.49-13.redhat_00011.1.el8jws |
| Red Hat jboss enterprise web server 6.2 | jws6-tomcat-javadoc | 0:10.1.49-13.redhat_00011.1.el10jws |
| Red Hat jboss enterprise web server 6.2 | jws6-tomcat-jsp-3.1-api | 0:10.1.49-13.redhat_00011.1.el9jws |
| Red Hat jboss enterprise web server 6.2 | jws6-tomcat-jsp-3.1-api | 0:10.1.49-13.redhat_00011.1.el10jws |
| Red Hat jboss enterprise web server 6.2 | jws6-tomcat-jsp-3.1-api | 0:10.1.49-13.redhat_00011.1.el8jws |
| Red Hat jboss enterprise web server 6.2 | jws6-tomcat-lib | 0:10.1.49-13.redhat_00011.1.el8jws |
| Red Hat jboss enterprise web server 6.2 | jws6-tomcat-lib | 0:10.1.49-13.redhat_00011.1.el9jws |
| Red Hat jboss enterprise web server 6.2 | jws6-tomcat-lib | 0:10.1.49-13.redhat_00011.1.el10jws |
| Red Hat jboss enterprise web server 6.2 | jws6-tomcat-selinux | 0:10.1.49-13.redhat_00011.1.el10jws |
| Red Hat jboss enterprise web server 6.2 | jws6-tomcat-selinux | 0:10.1.49-13.redhat_00011.1.el9jws |
| Red Hat jboss enterprise web server 6.2 | jws6-tomcat-selinux | 0:10.1.49-13.redhat_00011.1.el8jws |
| Red Hat jboss enterprise web server 6.2 | jws6-tomcat-servlet-6.0-api | 0:10.1.49-13.redhat_00011.1.el10jws |
| Red Hat jboss enterprise web server 6.2 | jws6-tomcat-servlet-6.0-api | 0:10.1.49-13.redhat_00011.1.el8jws |
| Red Hat jboss enterprise web server 6.2 | jws6-tomcat-servlet-6.0-api | 0:10.1.49-13.redhat_00011.1.el9jws |
| Red Hat jboss enterprise web server 6.2 | jws6-tomcat-webapps | 0:10.1.49-13.redhat_00011.1.el10jws |
| Red Hat jboss enterprise web server 6.2 | jws6-tomcat-webapps | 0:10.1.49-13.redhat_00011.1.el9jws |
| Red Hat jboss enterprise web server 6.2 | jws6-tomcat-webapps | 0:10.1.49-13.redhat_00011.1.el8jws |
| Rocky Linux 10 | tomcat9 | 1:9.0.117-1.el10_2 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | tomcat | 9.0.117-150200.105.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | tomcat | 9.0.117-150200.105.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | tomcat | 9.0.117-150200.105.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | tomcat10 | 10.1.54-150200.5.64.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | tomcat | 9.0.117-150200.105.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | tomcat10 | 10.1.54-150200.5.64.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP7 | tomcat | 9.0.117-150200.105.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP7 | tomcat10 | 10.1.54-150200.5.64.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP7 | tomcat11 | 11.0.21-150600.13.18.1 |
| SUSE Linux Enterprise Server 12 SP5-LTSS | tomcat | 9.0.117-3.163.2 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | tomcat | 9.0.117-150200.105.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | tomcat | 9.0.117-150200.105.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | tomcat10 | 10.1.54-150200.5.64.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | tomcat | 9.0.117-150200.105.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | tomcat10 | 10.1.54-150200.5.64.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | tomcat11 | 11.0.21-150600.13.18.1 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | tomcat | 9.0.117-3.163.2 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | tomcat | 9.0.117-150200.105.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | tomcat | 9.0.117-150200.105.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | tomcat10 | 10.1.54-150200.5.64.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | tomcat | 9.0.117-150200.105.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | tomcat10 | 10.1.54-150200.5.64.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | tomcat11 | 11.0.21-150600.13.18.1 |
| Ubuntu 25.10 | tomcat10 | no fix |
| Ubuntu 25.10 | tomcat11 | no fix |
| Ubuntu 25.10 | tomcat9 | no fix |
| Ubuntu 26.04 LTS | tomcat10 | no fix |
| Ubuntu 26.04 LTS | tomcat11 | no fix |
| Ubuntu 26.04 LTS | tomcat9 | no fix |
| Wolfi | thingsboard-tb-mqtt-transport | 4.3.1.1-r11 |
| Wolfi | thingsboard-tb-node | 4.3.1.1-r11 |
| openSUSE Leap 16.0 | tomcat | 9.0.117-160000.1.1 |
| openSUSE Leap 16.0 | tomcat10 | 10.1.54-160000.1.1 |
| openSUSE Leap 16.0 | tomcat11 | 11.0.21-160000.1.1 |
| openSUSE Tumbleweed | tomcat | 9.0.117-1.1 |
| openSUSE Tumbleweed | tomcat10 | 10.1.54-1.1 |
| openSUSE Tumbleweed | tomcat11 | 11.0.21-1.1 |