CVE-2026-29145: Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-09 · updated 2026-10-26
Weakness: CWE-287

Description

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13. Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.

Affected products

Apache Tomcat: from 9.0.83 before 9.0.116; from 10.1.1 before 10.1.53; from 11.0.0 before 11.0.20; 10.1.0, 10.1.0-milestone10, 10.1.0-milestone11, 10.1.0-milestone12, 10.1.0-milestone13, 10.1.0-milestone14 (+9) — fixed in 9.0.116, 10.1.53, 11.0.20
Apache Software Foundation Apache Tomcat Native: from 1.1.23 before 1.3.7; from 2.0.0 before 2.0.14 — fixed in 1.3.7, 2.0.14

How to fix

Upgrade to a fixed version: Apache Tomcat 9.0.116, 10.1.53, 11.0.20; Apache Software Foundation Apache Tomcat Native 1.3.7, 2.0.14. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-29145 or the next vulnerability affects your stack