CVE-2026-34500 Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled

What is CVE-2026-34500?

CVE-2026-34500 is a medium-severity authentication bypass vulnerability in Apache Tomcat, published on 9 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue.

Weakness: CWE-287

Which versions are affected by CVE-2026-34500?

7 open source packages ship an affected version, including org.apache.tomcat:tomcat-coyote-ffm and tomcat. It affects 1 product.

Products include Apache Tomcat.

How do I fix CVE-2026-34500?

Upgrade org.apache.tomcat:tomcat-coyote-ffm to a fixed version for your release line: 10.1.54, 11.0.21 or 9.0.117.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-34500 being exploited?

There is no known exploitation of CVE-2026-34500 in the wild and no public exploit code.

Other vulnerabilities in Apache Tomcat

• CVE-2025-24813 Apache Tomcat Path Equivalence Exploited Critical 10.0
• CVE-2016-8735 Apache Tomcat Remote Code Execution Exploited Critical 9.8
• CVE-2017-12617 Apache Tomcat Remote Code Execution Exploited High 8.1
• CVE-2017-12615 Apache Tomcat on Windows Remote Code Execution Exploited High 8.1
• CVE-2026-34486 Apache Tomcat Missing Encryption of Sensitive Data Exploited High 7.5

All Apache Tomcat vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-tomcat-2026-34500, CLEANSTART-2026-SZ16719, DEBIAN-CVE-2026-34500, GHSA-24j9-x2wg-9qv6, ROOT-APP-MAVEN-CVE-2026-34500, UBUNTU-CVE-2026-34500.