CVE-2026-74048 Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-74048?
CVE-2026-74048 is a medium-severity vulnerability in Apache Tomcat, published on 20 Oct 2026.
Official description
Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration.
This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.26, from 10.1.22 through 10.1.60, from 9.0.92 through 9.0.122.
Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.
Weakness: CWE-636
Which versions are affected by CVE-2026-74048?
1 open source package ship an affected version, including tomcat.
| Package | Affected | Fixed in |
|---|---|---|
tomcat Bitnami | From 9.0.92 | 9.0.123, 10.1.61, 11.0.27 |
How do I fix CVE-2026-74048?
Upgrade tomcat to a fixed version for your release line: 9.0.123, 10.1.61 or 11.0.27.
Is CVE-2026-74048 being exploited?
There is no known exploitation of CVE-2026-74048 in the wild and no public exploit code.
Sources
Also known as BIT-tomcat-2026-74048, DEBIAN-CVE-2026-74048, GHSA-38jj-69cp-9wgc, UBUNTU-CVE-2026-74048.