CVE-2026-74048

Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.26, from 10.1.22 through 10.1.60, from 9.0.92 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread.html/v5ry0sx1c7x1wr5mx4cddj3p3mv1ho6m
http://www.openwall.com/lists/oss-security/2026/10/20/21

Configurations

No configuration.

History

29 Oct 2026, 18:17

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 6.5

20 Oct 2026, 19:18

Type	Values Removed	Values Added
References		() http://www.openwall.com/lists/oss-security/2026/10/20/21 -

20 Oct 2026, 14:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-20 14:17

Updated : 2026-10-29 18:17

NVD link : CVE-2026-74048

Mitre link : CVE-2026-74048

CVE.ORG link : CVE-2026-74048

JSON object : View

Products Affected

No product.

CWE

CWE-636

Not Failing Securely ('Failing Open')

{"id": "CVE-2026-74048", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-74048", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-29T17:44:51.132724Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Tomcat", "versions": [{"status": "affected", "version": "11.0.0-M14", "versionType": "semver", "lessThanOrEqual": "11.0.26"}, {"status": "affected", "version": "10.1.22", "versionType": "semver", "lessThanOrEqual": "10.1.60"}, {"status": "affected", "version": "9.0.92", "versionType": "semver", "lessThanOrEqual": "9.0.122"}], "defaultStatus": "unaffected"}]}], "published": "2026-10-20T14:17:00.563", "references": [{"url": "https://lists.apache.org/thread.html/v5ry0sx1c7x1wr5mx4cddj3p3mv1ho6m", "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/10/20/21", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-636"}]}], "descriptions": [{"lang": "en", "value": "Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. If the\u00a0OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.26, from 10.1.22 through 10.1.60, from 9.0.92 through 9.0.122.\n\n\n\nUsers are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue."}], "lastModified": "2026-10-29T18:17:34.567", "sourceIdentifier": "security@apache.org"}