GHSA-24j9-x2wg-9qv6

Source

https://github.com/advisories/GHSA-24j9-x2wg-9qv6

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-24j9-x2wg-9qv6/GHSA-24j9-x2wg-9qv6.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-24j9-x2wg-9qv6

Aliases

Downstream

CGA (40)

Published

2026-04-09T21:31:30Z

Modified

2026-07-17T21:16:27Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N CVSS Calculator

Summary

Apache Tomcat: CLIENT_CERT authentication does not fail as expected

Details

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue.

Database specific

{
    "cwe_ids":  [
        "CWE-287"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-04-10T21:38:56Z",
    "nvd_published_at":  "2026-04-09T20:16:25Z",
    "severity":  "MODERATE"
}

References

Affected packages

Maven

org.apache.tomcat:tomcat-coyote-ffm

Package

Name: org.apache.tomcat:tomcat-coyote-ffm; View open source insights on deps.dev
Purl: pkg:maven/org.apache.tomcat/tomcat-coyote-ffm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

9.0.92

Fixed

9.0.117

Affected versions

9.*

9.0.93

9.0.94

9.0.95

9.0.96

9.0.97

9.0.98

9.0.99

9.0.100

9.0.102

9.0.104

9.0.105

9.0.106

9.0.107

9.0.108

9.0.109

9.0.110

9.0.111

9.0.112

9.0.113

9.0.115

9.0.116

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-24j9-x2wg-9qv6/GHSA-24j9-x2wg-9qv6.json"

org.apache.tomcat:tomcat-coyote-ffm

Package

Name: org.apache.tomcat:tomcat-coyote-ffm; View open source insights on deps.dev
Purl: pkg:maven/org.apache.tomcat/tomcat-coyote-ffm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

10.1.22

Fixed

10.1.54

Affected versions

10.*

10.1.26

10.1.28

10.1.29

10.1.30

10.1.31

10.1.33

10.1.34

10.1.35

10.1.36

10.1.39

10.1.40

10.1.41

10.1.42

10.1.43

10.1.44

10.1.45

10.1.46

10.1.47

10.1.48

10.1.49

10.1.50

10.1.52

10.1.53

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-24j9-x2wg-9qv6/GHSA-24j9-x2wg-9qv6.json"

org.apache.tomcat:tomcat-coyote-ffm

Package

Name: org.apache.tomcat:tomcat-coyote-ffm; View open source insights on deps.dev
Purl: pkg:maven/org.apache.tomcat/tomcat-coyote-ffm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

11.0.0-M14

Fixed

11.0.21

Affected versions

11.*

11.0.0-M22

11.0.0-M24

11.0.0-M25

11.0.0-M26

11.0.0

11.0.1

11.0.2

11.0.3

11.0.4

11.0.5

11.0.6

11.0.7

11.0.8

11.0.9

11.0.10

11.0.11

11.0.12

11.0.13

11.0.14

11.0.15

11.0.18

11.0.20

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-24j9-x2wg-9qv6/GHSA-24j9-x2wg-9qv6.json"