CVE-2026-34500: Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-09 · updated 2026-10-26
Weakness: CWE-287

Description

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue.

Affected products

Apache Tomcat: from 9.0.92 before 9.0.117; from 10.1.22 before 10.1.54; from 11.0.1 before 11.0.21; 11.0.0-milestone14, 11.0.0-milestone15, 11.0.0-milestone16, 11.0.0-milestone17, 11.0.0-milestone18, 11.0.0-milestone19 (+7) — fixed in 9.0.117, 10.1.54, 11.0.21

How to fix

Upgrade to a fixed version: Apache Tomcat 9.0.117, 10.1.54, 11.0.21. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-34500 or the next vulnerability affects your stack