Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2026-29145

Опубликовано: 09 апр. 2026
Источник: nvd
CVSS3: 9.1
EPSS Низкий

Описание

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13.

Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
Версия от 9.0.83 (включая) до 9.0.116 (исключая)
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
Версия от 10.1.1 (включая) до 10.1.53 (исключая)
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
Версия от 11.0.0 (включая) до 11.0.20 (исключая)
cpe:2.3:a:apache:tomcat:10.1.0:-:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.1.0:milestone10:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.1.0:milestone11:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.1.0:milestone12:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.1.0:milestone13:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.1.0:milestone14:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.1.0:milestone15:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.1.0:milestone16:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.1.0:milestone17:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.1.0:milestone18:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.1.0:milestone19:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.1.0:milestone20:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.1.0:milestone7:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.1.0:milestone8:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat:10.1.0:milestone9:*:*:*:*:*:*
cpe:2.3:a:apache:tomcat_native:*:*:*:*:*:*:*:*
Версия от 1.1.23 (включая) до 1.3.7 (исключая)
cpe:2.3:a:apache:tomcat_native:*:*:*:*:*:*:*:*
Версия от 2.0.0 (включая) до 2.0.14 (исключая)

EPSS

Процентиль: 50%
0.00715
Низкий

9.1 Critical

CVSS3

Дефекты

CWE-287

Связанные уязвимости

ubuntu логотип

CVE-2026-29145

CVSS3: 9.1
ubuntu
4 месяца назад

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13. Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.

redhat логотип

CVE-2026-29145

CVSS3: 5.9
redhat
4 месяца назад

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13. Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.

debian логотип

CVE-2026-29145

CVSS3: 9.1
debian
4 месяца назад

CLIENT_CERT authentication does not fail as expected for some scenario ...

github логотип

GHSA-95jq-rwvf-vjx4

CVSS3: 9.1
github
4 месяца назад

Apache Tomcat: CLIENT_CERT authentication does not fail as expected

fstec логотип

BDU:2026-06931

CVSS3: 9.1
fstec
4 месяца назад

Уязвимость сервера приложений Apache Tomcat, связанная с недостатками процедуры аутентификации, позволяющая нарушителю повысить свои привилегии

EPSS

Процентиль: 50%
0.00715
Низкий

9.1 Critical

CVSS3

Дефекты

CWE-287