CVE-2026-24734
- Source
- https://cve.org/CVERecord?id=CVE-2026-24734
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-24734.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2026-24734
- Aliases
- Downstream
CGA (27)
- CGA-2cwr-qx3g-w3fx
- CGA-2j8q-66gc-h3mv
- CGA-3m89-7356-7f6v
- CGA-3qq4-6hfh-v68m
- CGA-4pvx-r3hf-2vq2
- CGA-5rhr-74vm-4gqr
- CGA-5xxq-xhhv-p328
- CGA-8pjm-vg8v-q2fw
- CGA-994v-xvvc-fwq2
- CGA-cp87-5qcp-rwr3
- CGA-crjc-jr43-w4m4
- CGA-f598-jc87-mqf9
- CGA-fgg2-367c-4964
- CGA-g2qg-mxh8-2f2v
- CGA-gm6v-7f23-p4q9
- CGA-j687-c8qv-gfgc
- CGA-jfg2-w3p8-pp4x
- CGA-m5w7-h783-2886
- CGA-m676-p9w3-w5rv
- CGA-m6jx-xxrj-xh34
- CGA-mh8q-m735-vwfv
- CGA-qwvr-9w8v-w26c
- CGA-rh2m-fpxp-9p4m
- CGA-rpw3-vhhh-hxx9
- CGA-rx6g-ppjq-8f72
- CGA-v6qp-pxc4-m489
- CGA-vw4p-mrch-gcc7
CLEANSTART (1)
DEBIAN (1)
MGASA (1)
MINI (6)
OESA (1)
openSUSE (6)
ROOT (1)
SUSE (5)
UBUNTU (1)
- Related
- Published
- 2026-02-17T18:53:12Z
- Modified
- 2026-10-16T02:58:37Z
- Severity
-
- 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
- Summary
- Apache Tomcat Native, Apache Tomcat: OCSP revocation bypass
- Details
-
Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat.
When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification or freshness checks on the OCSP response which could allow certificate revocation to be bypassed.
This issue affects Apache Tomcat Native: from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11; Apache Tomcat: from 11.0.0-M1 through 11.0.17, from 10.1.0-M7 through 10.1.51, from 9.0.83 through 9.0.114.
The following versions were EOL at the time the CVE was created but are known to be affected: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39. Older EOL versions are not affected.
Apache Tomcat Native users are recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which fix the issue.
Apache Tomcat users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115 or later which fix the issue.
- Database specific
{ "cna_assigner": "apache", "cwe_ids": [ "CWE-20" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24734.json", "unresolved_ranges": [ { "extracted_events": [ { "range": [ { "introduced": "1.1.23" }, { "last_affected": "1.1.34" }, { "introduced": "1.2.0" }, { "last_affected": "1.2.39" }, { "introduced": "1.3.0" }, { "last_affected": "1.3.4" }, { "introduced": "2.0.0" }, { "last_affected": "2.0.11" }, { "introduced": "11.0.0-M1" }, { "last_affected": "11.0.17" }, { "introduced": "10.1.0-M7" }, { "last_affected": "10.1.51" }, { "introduced": "9.0.83" }, { "last_affected": "9.0.114" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" } ] } ] }- References
-
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24734.json
- https://access.redhat.com/errata/RHSA-2026:19054
- https://access.redhat.com/errata/RHSA-2026:26323
- https://access.redhat.com/errata/RHSA-2026:36790
- https://access.redhat.com/errata/RHSA-2026:5611
- https://access.redhat.com/errata/RHSA-2026:5612
- https://access.redhat.com/errata/RHSA-2026:6569
- https://access.redhat.com/errata/RHSA-2026:8334
- https://access.redhat.com/security/cve/CVE-2026-24734
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24734.json
- https://lists.apache.org/thread/292dlmx3fz1888v6v16221kpozq56gml
- https://nvd.nist.gov/vuln/detail/CVE-2026-24734
- https://bugzilla.redhat.com/show_bug.cgi?id=2440426
Affected packages
Git / github.com/apache/tomcat
Affected ranges
- Type
- GIT
- Repo
- https://github.com/apache/tomcat
- Events
-
IntroducedLast Affected
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone1:*:*:*:*:*:*", "range": [ { "introduced": "10.1.0-milestone1" }, { "last_affected": "10.1.0-milestone1" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone10:*:*:*:*:*:*", "range": [ { "introduced": "10.1.0-milestone10" }, { "last_affected": "10.1.0-milestone10" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone11:*:*:*:*:*:*", "range": [ { "introduced": "10.1.0-milestone11" }, { "last_affected": "10.1.0-milestone11" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone12:*:*:*:*:*:*", "range": [ { "introduced": "10.1.0-milestone12" }, { "last_affected": "10.1.0-milestone12" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone13:*:*:*:*:*:*", "range": [ { "introduced": "10.1.0-milestone13" }, { "last_affected": "10.1.0-milestone13" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone14:*:*:*:*:*:*", "range": [ { "introduced": "10.1.0-milestone14" }, { "last_affected": "10.1.0-milestone14" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone15:*:*:*:*:*:*", "range": [ { "introduced": "10.1.0-milestone15" }, { "last_affected": "10.1.0-milestone15" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone16:*:*:*:*:*:*", "range": [ { "introduced": "10.1.0-milestone16" }, { "last_affected": "10.1.0-milestone16" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone17:*:*:*:*:*:*", "range": [ { "introduced": "10.1.0-milestone17" }, { "last_affected": "10.1.0-milestone17" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone18:*:*:*:*:*:*", "range": [ { "introduced": "10.1.0-milestone18" }, { "last_affected": "10.1.0-milestone18" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone19:*:*:*:*:*:*", "range": [ { "introduced": "10.1.0-milestone19" }, { "last_affected": "10.1.0-milestone19" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone2:*:*:*:*:*:*", "range": [ { "introduced": "10.1.0-milestone2" }, { "last_affected": "10.1.0-milestone2" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone20:*:*:*:*:*:*", "range": [ { "introduced": "10.1.0-milestone20" }, { "last_affected": "10.1.0-milestone20" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone3:*:*:*:*:*:*", "range": [ { "introduced": "10.1.0-milestone3" }, { "last_affected": "10.1.0-milestone3" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone4:*:*:*:*:*:*", "range": [ { "introduced": "10.1.0-milestone4" }, { "last_affected": "10.1.0-milestone4" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone5:*:*:*:*:*:*", "range": [ { "introduced": "10.1.0-milestone5" }, { "last_affected": "10.1.0-milestone5" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone6:*:*:*:*:*:*", "range": [ { "introduced": "10.1.0-milestone6" }, { "last_affected": "10.1.0-milestone6" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone7:*:*:*:*:*:*", "range": [ { "introduced": "10.1.0-milestone7" }, { "last_affected": "10.1.0-milestone7" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone8:*:*:*:*:*:*", "range": [ { "introduced": "10.1.0-milestone8" }, { "last_affected": "10.1.0-milestone8" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:10.1.0:milestone9:*:*:*:*:*:*", "range": [ { "introduced": "10.1.0-milestone9" }, { "last_affected": "10.1.0-milestone9" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:11.0.0:milestone1:*:*:*:*:*:*", "range": [ { "introduced": "11.0.0-milestone1" }, { "last_affected": "11.0.0-milestone1" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:11.0.0:milestone10:*:*:*:*:*:*", "range": [ { "introduced": "11.0.0-milestone10" }, { "last_affected": "11.0.0-milestone10" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:11.0.0:milestone11:*:*:*:*:*:*", "range": [ { "introduced": "11.0.0-milestone11" }, { "last_affected": "11.0.0-milestone11" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:11.0.0:milestone12:*:*:*:*:*:*", "range": [ { "introduced": "11.0.0-milestone12" }, { "last_affected": "11.0.0-milestone12" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:11.0.0:milestone13:*:*:*:*:*:*", "range": [ { "introduced": "11.0.0-milestone13" }, { "last_affected": "11.0.0-milestone13" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:11.0.0:milestone14:*:*:*:*:*:*", "range": [ { "introduced": "11.0.0-milestone14" }, { "last_affected": "11.0.0-milestone14" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:11.0.0:milestone15:*:*:*:*:*:*", "range": [ { "introduced": "11.0.0-milestone15" }, { "last_affected": "11.0.0-milestone15" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:11.0.0:milestone16:*:*:*:*:*:*", "range": [ { "introduced": "11.0.0-milestone16" }, { "last_affected": "11.0.0-milestone16" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:11.0.0:milestone17:*:*:*:*:*:*", "range": [ { "introduced": "11.0.0-milestone17" }, { "last_affected": "11.0.0-milestone17" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:11.0.0:milestone18:*:*:*:*:*:*", "range": [ { "introduced": "11.0.0-milestone18" }, { "last_affected": "11.0.0-milestone18" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:11.0.0:milestone19:*:*:*:*:*:*", "range": [ { "introduced": "11.0.0-milestone19" }, { "last_affected": "11.0.0-milestone19" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:11.0.0:milestone2:*:*:*:*:*:*", "range": [ { "introduced": "11.0.0-milestone2" }, { "last_affected": "11.0.0-milestone2" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:11.0.0:milestone20:*:*:*:*:*:*", "range": [ { "introduced": "11.0.0-milestone20" }, { "last_affected": "11.0.0-milestone20" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:11.0.0:milestone21:*:*:*:*:*:*", "range": [ { "introduced": "11.0.0-milestone21" }, { "last_affected": "11.0.0-milestone21" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:11.0.0:milestone22:*:*:*:*:*:*", "range": [ { "introduced": "11.0.0-milestone22" }, { "last_affected": "11.0.0-milestone22" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:11.0.0:milestone23:*:*:*:*:*:*", "range": [ { "introduced": "11.0.0-milestone23" }, { "last_affected": "11.0.0-milestone23" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:11.0.0:milestone24:*:*:*:*:*:*", "range": [ { "introduced": "11.0.0-milestone24" }, { "last_affected": "11.0.0-milestone24" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:11.0.0:milestone25:*:*:*:*:*:*", "range": [ { "introduced": "11.0.0-milestone25" }, { "last_affected": "11.0.0-milestone25" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:11.0.0:milestone26:*:*:*:*:*:*", "range": [ { "introduced": "11.0.0-milestone26" }, { "last_affected": "11.0.0-milestone26" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:11.0.0:milestone3:*:*:*:*:*:*", "range": [ { "introduced": "11.0.0-milestone3" }, { "last_affected": "11.0.0-milestone3" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:11.0.0:milestone4:*:*:*:*:*:*", "range": [ { "introduced": "11.0.0-milestone4" }, { "last_affected": "11.0.0-milestone4" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:11.0.0:milestone5:*:*:*:*:*:*", "range": [ { "introduced": "11.0.0-milestone5" }, { "last_affected": "11.0.0-milestone5" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:11.0.0:milestone6:*:*:*:*:*:*", "range": [ { "introduced": "11.0.0-milestone6" }, { "last_affected": "11.0.0-milestone6" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:11.0.0:milestone7:*:*:*:*:*:*", "range": [ { "introduced": "11.0.0-milestone7" }, { "last_affected": "11.0.0-milestone7" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:11.0.0:milestone8:*:*:*:*:*:*", "range": [ { "introduced": "11.0.0-milestone8" }, { "last_affected": "11.0.0-milestone8" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:apache:tomcat:11.0.0:milestone9:*:*:*:*:*:*", "range": [ { "introduced": "11.0.0-milestone9" }, { "last_affected": "11.0.0-milestone9" } ], "source": "CPE_STRING" } ] }
Affected versions
10.*
10.1.0-milestone1
10.1.0-milestone10
10.1.0-milestone11
10.1.0-milestone12
10.1.0-milestone13
10.1.0-milestone14
10.1.0-milestone15
10.1.0-milestone16
10.1.0-milestone17
10.1.0-milestone18
10.1.0-milestone19
10.1.0-milestone2
10.1.0-milestone20
10.1.0-milestone3
10.1.0-milestone4
10.1.0-milestone5
10.1.0-milestone6
10.1.0-milestone7
10.1.0-milestone8
10.1.0-milestone9
11.*
11.0.0-milestone1
11.0.0-milestone10
11.0.0-milestone11
11.0.0-milestone12
11.0.0-milestone13
11.0.0-milestone14
11.0.0-milestone15
11.0.0-milestone16
11.0.0-milestone17
11.0.0-milestone18
11.0.0-milestone19
11.0.0-milestone2
11.0.0-milestone20
11.0.0-milestone21
11.0.0-milestone22
11.0.0-milestone23
11.0.0-milestone24
11.0.0-milestone25
11.0.0-milestone26
11.0.0-milestone3
11.0.0-milestone4
11.0.0-milestone5
11.0.0-milestone6
11.0.0-milestone7
11.0.0-milestone8
11.0.0-milestone9
Git / github.com/apache/tomcat-native
Affected ranges
- Type
- GIT
- Repo
- https://github.com/apache/tomcat-native
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:apache:tomcat_native:*:*:*:*:*:*:*:*", "range": [ { "introduced": "1.3.0" }, { "fixed": "1.3.5" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:apache:tomcat_native:*:*:*:*:*:*:*:*", "range": [ { "introduced": "2.0.0" }, { "fixed": "2.0.12" } ], "source": "CPE_RANGE" } ] }