CVE-2026-34500

Опубликовано: 09 апр. 2026

Источник: nvd

CVSS3: 6.5

EPSS Низкий

Описание

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue.

Ссылки

https://lists.apache.org/thread/7rcl4zdxryc8hy3htyfyxkbqpxjtfdl2
Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/04/09/29
Mailing List
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

Версия от 9.0.92 (включая) до 9.0.117 (исключая)

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

Версия от 10.1.22 (включая) до 10.1.54 (исключая)

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

Версия от 11.0.1 (включая) до 11.0.21 (исключая)

cpe:2.3:a:apache:tomcat:11.0.0:milestone14:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone15:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone16:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone17:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone18:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone19:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone20:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone21:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone22:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone23:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone24:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone25:*:*:*:*:*:*

cpe:2.3:a:apache:tomcat:11.0.0:milestone26:*:*:*:*:*:*

EPSS

Процентиль: 38%

0.00469

Низкий

6.5 Medium

CVSS3

Дефекты

CWE-287

Связанные уязвимости

CVE-2026-34500

CVSS3: 6.5

ubuntu

4 месяца назад

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue.

CVE-2026-34500

CVSS3: 5.9

redhat

4 месяца назад

CVE-2026-34500

CVSS3: 6.5

debian

4 месяца назад

CLIENT_CERT authentication does not fail as expected for some scenario ...

GHSA-24j9-x2wg-9qv6

CVSS3: 6.5

github

4 месяца назад

Apache Tomcat: CLIENT_CERT authentication does not fail as expected

BDU:2026-07146

CVSS3: 6.5

fstec

4 месяца назад

Уязвимость сервера приложений Apache Tomcat, связанная c недостатками процедуры аутентификации, позволяющая нарушителю повысить свои привилегии

EPSS

Процентиль: 38%

0.00469

Низкий

6.5 Medium

CVSS3

Дефекты

CWE-287