CVE-2026-34500

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-34500
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-34500.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-34500
Aliases
Downstream
Related
Published
2026-04-09T19:36:52.857Z
Modified
2026-05-18T06:00:02.119512587Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N CVSS Calculator
Summary
Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled
Details

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue.

Database specific 
{
    "cna_assigner": "apache",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34500.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "11.0.0-M14"
                },
                {
                    "last_affected": "11.0.20"
                },
                {
                    "introduced": "10.1.22"
                },
                {
                    "last_affected": "10.1.53"
                },
                {
                    "introduced": "9.0.92"
                },
                {
                    "last_affected": "9.0.116"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "source": "DESCRIPTION",
            "extracted_events": [
                {
                    "introduced": "11.0.0-M14"
                },
                {
                    "fixed": "11.0.20"
                },
                {
                    "introduced": "10.1.22"
                },
                {
                    "fixed": "10.1.53"
                },
                {
                    "introduced": "9.0.92"
                },
                {
                    "fixed": "9.0.116"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/apache/tomcat

Affected ranges

Type
GIT
Repo
https://github.com/apache/tomcat
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
9108a1f6776f7211f5cd27e80b7b5a6e98116b01
Last affected
a22029c7147b83e4fbced16add744903245d1147
Last affected
ca6ea22e9b6c47df1db85e9af80f80431c3ea19e
Last affected
110bc36637569f7e9d191d21ac8600a8667cfc94
Last affected
eee0dbb29048a60ee2c85ebcb9abb1750046c0bf
Last affected
19e301275f23056e3c46ab296c87cf6e16fbe68f
Last affected
c400bf727cbc10198d3f52c29849d18660050b0c
Last affected
2acc5c10a303d6ae7a28c2959432aef98ae29016
Last affected
6c03e2dc6390ccb3dbe714889706fcad2f08f4c5
Last affected
2bf2c6a691ad9f2cf68363123419909cebbb308a
Last affected
5301df36454fcf22081108e25199f29904cadc79
Last affected
fafe3dc7a63c12fbb45aa076c90d6a9e7f77e5c8
Last affected
e9935d107776339a4a48cf4e32195a763fbf8379
Database specific 
{
    "source": "CPE_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "11.0.0-milestone14"
        },
        {
            "last_affected": "11.0.0-milestone15"
        },
        {
            "last_affected": "11.0.0-milestone16"
        },
        {
            "last_affected": "11.0.0-milestone17"
        },
        {
            "last_affected": "11.0.0-milestone18"
        },
        {
            "last_affected": "11.0.0-milestone19"
        },
        {
            "last_affected": "11.0.0-milestone20"
        },
        {
            "last_affected": "11.0.0-milestone21"
        },
        {
            "last_affected": "11.0.0-milestone22"
        },
        {
            "last_affected": "11.0.0-milestone23"
        },
        {
            "last_affected": "11.0.0-milestone24"
        },
        {
            "last_affected": "11.0.0-milestone25"
        },
        {
            "last_affected": "11.0.0-milestone26"
        }
    ],
    "cpe": [
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone14:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone15:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone16:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone17:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone18:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone19:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone20:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone21:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone22:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone23:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone24:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone25:*:*:*:*:*:*",
        "cpe:2.3:a:apache:tomcat:11.0.0:milestone26:*:*:*:*:*:*"
    ]
}

Affected versions

11.*
11.0.0-M14
11.0.0-M15
11.0.0-M16
11.0.0-M17
11.0.0-M18
11.0.0-M19
11.0.0-M20
11.0.0-M21
11.0.0-M22
11.0.0-M23
11.0.0-M24
11.0.0-M25
11.0.0-M26

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-34500.json"