CVE-2026-24734

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-24734
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-24734.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-24734
Aliases
Downstream
Related
Published
2026-02-17T18:53:12.228Z
Modified
2026-07-16T03:47:55.278294011Z
Severity
  • 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Apache Tomcat Native, Apache Tomcat: OCSP revocation bypass
Details

Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat.

When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification or freshness checks on the OCSP response which could allow certificate revocation to be bypassed.

This issue affects Apache Tomcat Native:  from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11; Apache Tomcat: from 11.0.0-M1 through 11.0.17, from 10.1.0-M7 through 10.1.51, from 9.0.83 through 9.0.114.

The following versions were EOL at the time the CVE was created but are known to be affected: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39. Older EOL versions are not affected.

Apache Tomcat Native users are recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which fix the issue.

Apache Tomcat users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115 or later which fix the issue.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24734.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "1.1.23"
                },
                {
                    "last_affected": "1.1.34"
                },
                {
                    "introduced": "1.2.0"
                },
                {
                    "last_affected": "1.2.39"
                },
                {
                    "introduced": "1.3.0"
                },
                {
                    "last_affected": "1.3.4"
                },
                {
                    "introduced": "2.0.0"
                },
                {
                    "last_affected": "2.0.11"
                },
                {
                    "introduced": "11.0.0-M1"
                },
                {
                    "last_affected": "11.0.17"
                },
                {
                    "introduced": "10.1.0-M7"
                },
                {
                    "last_affected": "10.1.51"
                },
                {
                    "introduced": "9.0.83"
                },
                {
                    "last_affected": "9.0.114"
                }
            ]
        },
        {
            "source": "DESCRIPTION",
            "extracted_events": [
                {
                    "introduced": "1.3.0"
                },
                {
                    "fixed": "1.3.4"
                },
                {
                    "introduced": "2.0.0"
                },
                {
                    "fixed": "2.0.11"
                },
                {
                    "introduced": "11.0.0-M1"
                },
                {
                    "fixed": "11.0.17"
                },
                {
                    "introduced": "10.1.0-M7"
                },
                {
                    "fixed": "10.1.51"
                },
                {
                    "introduced": "9.0.83"
                },
                {
                    "fixed": "9.0.114"
                },
                {
                    "introduced": "1.1.23"
                },
                {
                    "fixed": "1.1.34"
                },
                {
                    "introduced": "1.2.0"
                },
                {
                    "fixed": "1.2.39"
                }
            ]
        }
    ],
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-20"
    ]
}
References

Affected packages

Git / github.com/apache/tomcat

Affected ranges

Type
GIT
Repo
https://github.com/apache/tomcat
Events
Introduced
f2ab9ac8bc3f40ee9b2cb50b030c99df927f0429
Last affected
de714a23642a4d0baef342db6762a7f7a550d82c
Database specific 
{
    "source": "CPE_STRING",
    "extracted_events": [
        {
            "introduced": "10.1.0-milestone1"
        },
        {
            "last_affected": "10.1.0-milestone1"
        },
        {
            "introduced": "10.1.0-milestone10"
        },
        {
            "last_affected": "10.1.0-milestone10"
        },
        {
            "introduced": "10.1.0-milestone11"
        },
        {
            "last_affected": "10.1.0-milestone11"
        },
        {
            "introduced": "10.1.0-milestone12"
        },
        {
            "last_affected": "10.1.0-milestone12"
        },
        {
            "introduced": "10.1.0-milestone13"
        },
        {
            "last_affected": "10.1.0-milestone13"
        },
        {
            "introduced": "10.1.0-milestone14"
        },
        {
            "last_affected": "10.1.0-milestone14"
        },
        {
            "introduced": "10.1.0-milestone15"
        },
        {
            "last_affected": "10.1.0-milestone15"
        },
        {
            "introduced": "10.1.0-milestone16"
        },
        {
            "last_affected": "10.1.0-milestone16"
        },
        {
            "introduced": "10.1.0-milestone17"
        },
        {
            "last_affected": "10.1.0-milestone17"
        },
        {
            "introduced": "10.1.0-milestone18"
        },
        {
            "last_affected": "10.1.0-milestone18"
        },
        {
            "introduced": "10.1.0-milestone19"
        },
        {
            "last_affected": "10.1.0-milestone19"
        },
        {
            "introduced": "10.1.0-milestone2"
        },
        {
            "last_affected": "10.1.0-milestone2"
        },
        {
            "introduced": "10.1.0-milestone20"
        },
        {
            "last_affected": "10.1.0-milestone20"
        },
        {
            "introduced": "10.1.0-milestone3"
        },
        {
            "last_affected": "10.1.0-milestone3"
        },
        {
            "introduced": "10.1.0-milestone4"
        },
        {
            "last_affected": "10.1.0-milestone4"
        },
        {
            "introduced": "10.1.0-milestone5"
        },
        {
            "last_affected": "10.1.0-milestone5"
        },
        {
            "introduced": "10.1.0-milestone6"
        },
        {
            "last_affected": "10.1.0-milestone6"
        },
        {
            "introduced": "10.1.0-milestone7"
        },
        {
            "last_affected": "10.1.0-milestone7"
        },
        {
            "introduced": "10.1.0-milestone8"
        },
        {
            "last_affected": "10.1.0-milestone8"
        },
        {
            "introduced": "10.1.0-milestone9"
        },
        {
            "last_affected": "10.1.0-milestone9"
        },
        {
            "introduced": "11.0.0-milestone1"
        },
        {
            "last_affected": "11.0.0-milestone1"
        },
        {
            "introduced": "11.0.0-milestone10"
        },
        {
            "last_affected": "11.0.0-milestone10"
        },
        {
            "introduced": "11.0.0-milestone11"
        },
        {
            "last_affected": "11.0.0-milestone11"
        },
        {
            "introduced": "11.0.0-milestone12"
        },
        {
            "last_affected": "11.0.0-milestone12"
        },
        {
            "introduced": "11.0.0-milestone13"
        },
        {
            "last_affected": "11.0.0-milestone13"
        },
        {
            "introduced": "11.0.0-milestone14"
        },
        {
            "last_affected": "11.0.0-milestone14"
        },
        {
            "introduced": "11.0.0-milestone15"
        },
        {
            "last_affected": "11.0.0-milestone15"
        },
        {
            "introduced": "11.0.0-milestone16"
        },
        {
            "last_affected": "11.0.0-milestone16"
        },
        {
            "introduced": "11.0.0-milestone17"
        },
        {
            "last_affected": "11.0.0-milestone17"
        },
        {
            "introduced": "11.0.0-milestone18"
        },
        {
            "last_affected": "11.0.0-milestone18"
        },
        {
            "introduced": "11.0.0-milestone19"
        },
        {
            "last_affected": "11.0.0-milestone19"
        },
        {
            "introduced": "11.0.0-milestone2"
        },
        {
            "last_affected": "11.0.0-milestone2"
        },
        {
            "introduced": "11.0.0-milestone20"
        },
        {
            "last_affected": "11.0.0-milestone20"
        },
        {
            "introduced": "11.0.0-milestone21"
        },
        {
            "last_affected": "11.0.0-milestone21"
        },
        {
            "introduced": "11.0.0-milestone22"
        },
        {
            "last_affected": "11.0.0-milestone22"
        },
        {
            "introduced": "11.0.0-milestone23"
        },
        {
            "last_affected": "11.0.0-milestone23"
        },
        {
            "introduced": "11.0.0-milestone24"
        },
        {
            "last_affected": "11.0.0-milestone24"
        },
        {
            "introduced": "11.0.0-milestone25"
        },
        {
            "last_affected": "11.0.0-milestone25"
        },
        {
            "introduced": "11.0.0-milestone26"
        },
        {
            "last_affected": "11.0.0-milestone26"
        },
        {
            "introduced": "11.0.0-milestone3"
        },
        {
            "last_affected": "11.0.0-milestone3"
        },
        {
            "introduced": "11.0.0-milestone4"
        },
        {
            "last_affected": "11.0.0-milestone4"
        },
        {
            "introduced": "11.0.0-milestone5"
        },
        {
            "last_affected": "11.0.0-milestone5"
        },
        {
            "introduced": "11.0.0-milestone6"
        },
        {
            "last_affected": "11.0.0-milestone6"
        },
        {
            "introduced": "11.0.0-milestone7"
        },
        {
            "last_affected": "11.0.0-milestone7"
        },
        {
            "introduced": "11.0.0-milestone8"
        },
        {
            "last_affected": "11.0.0-milestone8"
        },
        {
            "introduced": "11.0.0-milestone9"
        },
        {
            "last_affected": "11.0.0-milestone9"
        }
    ],
    "cpe": [
        "cpe:2.3:a:apache:tomcat:10.1.0:milestone1:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:10.1.0:milestone10:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:10.1.0:milestone11:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:10.1.0:milestone12:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:10.1.0:milestone13:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:10.1.0:milestone14:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:10.1.0:milestone15:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:10.1.0:milestone16:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:10.1.0:milestone17:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:10.1.0:milestone18:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:10.1.0:milestone19:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:10.1.0:milestone2:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:10.1.0:milestone20:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:10.1.0:milestone3:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:10.1.0:milestone4:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:10.1.0:milestone5:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:10.1.0:milestone6:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:10.1.0:milestone7:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:10.1.0:milestone8:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:10.1.0:milestone9:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone1:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone10:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone11:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone12:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone13:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone14:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone15:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone16:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone17:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone18:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone19:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone2:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone20:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone21:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone22:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone23:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone24:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone25:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone26:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone3:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone4:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone5:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone6:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone7:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone8:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone9:*:*:*:*:*:*"
    ]
}

Affected versions

10.*
10.1.0-milestone1
10.1.0-milestone10
10.1.0-milestone11
10.1.0-milestone12
10.1.0-milestone13
10.1.0-milestone14
10.1.0-milestone15
10.1.0-milestone16
10.1.0-milestone17
10.1.0-milestone18
10.1.0-milestone19
10.1.0-milestone2
10.1.0-milestone20
10.1.0-milestone3
10.1.0-milestone4
10.1.0-milestone5
10.1.0-milestone6
10.1.0-milestone7
10.1.0-milestone8
10.1.0-milestone9
11.*
11.0.0-milestone1
11.0.0-milestone10
11.0.0-milestone11
11.0.0-milestone12
11.0.0-milestone13
11.0.0-milestone14
11.0.0-milestone15
11.0.0-milestone16
11.0.0-milestone17
11.0.0-milestone18
11.0.0-milestone19
11.0.0-milestone2
11.0.0-milestone20
11.0.0-milestone21
11.0.0-milestone22
11.0.0-milestone23
11.0.0-milestone24
11.0.0-milestone25
11.0.0-milestone26
11.0.0-milestone3
11.0.0-milestone4
11.0.0-milestone5
11.0.0-milestone6
11.0.0-milestone7
11.0.0-milestone8
11.0.0-milestone9

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-24734.json"

Git / github.com/apache/tomcat-native

Affected ranges

Type
GIT
Repo
https://github.com/apache/tomcat-native
Events
Introduced
998746966815e1ae105cba9f2681d37cc30249bc
Fixed
889f7ef35155df1fc0947c427b944fa738da5fbe
Introduced
39c19afe4a3df7ea4fda778d82dc25bd494a110c
Fixed
ef01736dc00d154f9d6622b796cf121929dfca64
Database specific 
{
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "1.3.0"
        },
        {
            "fixed": "1.3.5"
        },
        {
            "introduced": "2.0.0"
        },
        {
            "fixed": "2.0.12"
        }
    ],
    "cpe": "cpe:2.3:a:apache:tomcat_native:*:*:*:*:*:*:*:*"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-24734.json"