{
  "threat_severity" : "Moderate",
  "public_date" : "2026-04-09T19:36:52Z",
  "bugzilla" : {
    "description" : "Apache Tomcat: Apache Tomcat: Authentication bypass via client certificate misconfiguration",
    "id" : "2457043",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2457043"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.9",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
    "status" : "verified"
  },
  "cwe" : "CWE-303",
  "details" : [ "CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat.\nThis issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116.\nUsers are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue.", "A flaw was found in Apache Tomcat where OCSP-based certificate validation may incorrectly soft-fail during CLIENT_CERT authentication, even when soft-fail is disabled, under certain FFM-related execution paths. This can result in client certificates being accepted despite failed or unverifiable revocation checks, weakening certificate validation in specific mTLS configurations." ],
  "statement" : "This flaw is rated Moderate rather than Important flaw because its impact is highly conditional and configuration-dependent, not broadly exploitable. The issue only manifests when CLIENT_CERT authentication, OCSP revocation checking, and soft-fail disabled are all explicitly configured, and even then only along specific execution paths involving the FFM API. There is no direct remote exploit primitive—an attacker would already need access to a client certificate that triggers an OCSP validation failure scenario (e.g., responder unavailability or malformed response) to potentially bypass revocation enforcement. Importantly, the vulnerability does not enable certificate forgery, private key compromise, or bypass of TLS authentication itself; it weakens enforcement of revocation status under edge conditions.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-07-08T00:00:00Z",
    "advisory" : "RHSA-2026:36790",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.2",
    "package" : "tomcat9-1:9.0.117-2.el10_2"
  }, {
    "product_name" : "Red Hat JBoss Web Server 6.2.3",
    "release_date" : "2026-05-26T00:00:00Z",
    "advisory" : "RHSA-2026:20406",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:6.2",
    "package" : "tomcat"
  }, {
    "product_name" : "Red Hat JBoss Web Server 6.2 on RHEL 10",
    "release_date" : "2026-05-26T00:00:00Z",
    "advisory" : "RHSA-2026:20405",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:6.2::el10",
    "package" : "jws6-tomcat-0:10.1.49-13.redhat_00011.1.el10jws"
  }, {
    "product_name" : "Red Hat JBoss Web Server 6.2 on RHEL 8",
    "release_date" : "2026-05-26T00:00:00Z",
    "advisory" : "RHSA-2026:20405",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:6.2::el8",
    "package" : "jws6-tomcat-0:10.1.49-13.redhat_00011.1.el8jws"
  }, {
    "product_name" : "Red Hat JBoss Web Server 6.2 on RHEL 9",
    "release_date" : "2026-05-26T00:00:00Z",
    "advisory" : "RHSA-2026:20405",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:6.2::el9",
    "package" : "jws6-tomcat-0:10.1.49-13.redhat_00011.1.el9jws"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Fix deferred",
    "package_name" : "tomcat",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Out of support scope",
    "package_name" : "tomcat6",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Fix deferred",
    "package_name" : "tomcat",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Fix deferred",
    "package_name" : "pki-deps:10.6/pki-servlet-engine",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Fix deferred",
    "package_name" : "tomcat",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "pki-servlet-engine",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "tomcat",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat JBoss Web Server 5",
    "fix_state" : "Under investigation",
    "package_name" : "tomcat",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_web_server:5"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-34500\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-34500\nhttps://lists.apache.org/thread/7rcl4zdxryc8hy3htyfyxkbqpxjtfdl2" ],
  "name" : "CVE-2026-34500",
  "mitigation" : {
    "value" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
    "lang" : "en:us"
  },
  "csaw" : false
}