CVE-2026-34500

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/7rcl4zdxryc8hy3htyfyxkbqpxjtfdl2	Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/04/09/29	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apache:tomcat::::::::
	cpe:2.3:a:apache:tomcat::::::::
	cpe:2.3:a:apache:tomcat::::::::
	cpe:2.3:a:apache:tomcat:11.0.0:milestone14::::::
	cpe:2.3:a:apache:tomcat:11.0.0:milestone15::::::
	cpe:2.3:a:apache:tomcat:11.0.0:milestone16::::::
	cpe:2.3:a:apache:tomcat:11.0.0:milestone17::::::
	cpe:2.3:a:apache:tomcat:11.0.0:milestone18::::::
	cpe:2.3:a:apache:tomcat:11.0.0:milestone19::::::
	cpe:2.3:a:apache:tomcat:11.0.0:milestone20::::::
	cpe:2.3:a:apache:tomcat:11.0.0:milestone21::::::
	cpe:2.3:a:apache:tomcat:11.0.0:milestone22::::::
	cpe:2.3:a:apache:tomcat:11.0.0:milestone23::::::
	cpe:2.3:a:apache:tomcat:11.0.0:milestone24::::::
	cpe:2.3:a:apache:tomcat:11.0.0:milestone25::::::
	cpe:2.3:a:apache:tomcat:11.0.0:milestone26::::::

History

No history.

Information

Published : 2026-04-09 20:16

Updated : 2026-06-17 10:39

NVD link : CVE-2026-34500

Mitre link : CVE-2026-34500

CVE.ORG link : CVE-2026-34500

JSON object : View

Products Affected

apache

tomcat

CWE

CWE-287

Improper Authentication

{"id": "CVE-2026-34500", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34500", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-10T14:21:50.556349Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Tomcat", "versions": [{"status": "affected", "version": "11.0.0-M14", "versionType": "semver", "lessThanOrEqual": "11.0.20"}, {"status": "affected", "version": "10.1.22", "versionType": "semver", "lessThanOrEqual": "10.1.53"}, {"status": "affected", "version": "9.0.92", "versionType": "semver", "lessThanOrEqual": "9.0.116"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-09T20:16:25.330", "references": [{"url": "https://lists.apache.org/thread/7rcl4zdxryc8hy3htyfyxkbqpxjtfdl2", "tags": ["Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/04/09/29", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116.\n\nUsers are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue."}], "lastModified": "2026-06-17T10:39:07.903", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0F8E9052-1F8B-4AE4-848E-8A68AF70799D", "versionEndExcluding": "9.0.117", "versionStartIncluding": "9.0.92"}, {"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0F59692A-17FE-42A3-83DF-FD362A4E74C7", "versionEndExcluding": "10.1.54", "versionStartIncluding": "10.1.22"}, {"criteria": "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C690419F-47D3-4770-8F15-7EF042E1567F", "versionEndExcluding": "11.0.21", "versionStartIncluding": "11.0.1"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone14:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "72D3C6F1-84FA-4F82-96C1-9A8DA1C1F30F"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone15:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3521C81B-37D9-48FC-9540-D0D333B9A4A4"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone16:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "02A84634-A8F2-4BA9-B9F3-BEF36AEC5480"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone17:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ECBBC1F1-C86B-40AF-B740-A99F6B27682A"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone18:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9D2206B2-F3FF-43F2-B3E2-3CAAC64C691D"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone19:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0495A538-4102-40D0-A35C-0179CFD52A9D"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone20:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "77BA6600-0890-4BA1-B447-EC1746BAB4FD"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone21:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7914D26B-CBD6-4846-9BD3-403708D69319"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone22:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "123C6285-03BE-49FC-B821-8BDB25D02863"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone23:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8A28C2E2-B7BC-46CE-94E4-AE3EF172AA47"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone24:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "069B0D8E-8223-4C4E-A834-C6235D6C3450"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone25:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E6282085-5716-4874-B0B0-180ECDEE128F"}, {"criteria": "cpe:2.3:a:apache:tomcat:11.0.0:milestone26:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "899B6FF0-8701-47E7-8EDA-428A6D48786D"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}