Executive brief
Apache Tomcat, a widely used web server for Java applications, contains a security flaw in how it verifies digital certificates. When checking if a certificate has been cancelled (revoked), the system fails to properly validate the response from the verification service. This could allow an attacker to use a stolen or invalid certificate to gain unauthorized access to secure systems, potentially compromising sensitive data or operations.
Technical details
An improper input validation vulnerability exists in Apache Tomcat Native and the FFM port of Tomcat Native code. The flaw occurs during the processing of Online Certificate Status Protocol (OCSP) responses, where the software fails to complete necessary verification or freshness checks. A remote, unauthenticated attacker can exploit this by providing a specially crafted or stale OCSP response, effectively bypassing certificate revocation lists. This allows the use of revoked certificates for TLS authentication. Patches are available in Tomcat versions 11.0.18, 10.1.52, and 9.0.115, and Tomcat Native versions 1.3.5 and 2.0.12.
Affected products
- Apache Tomcat Native 1.3.0 through 1.3.4, 2.0.0 through 2.0.11, 1.1.23 through 1.1.34, 1.2.0 through 1.2.39
- Apache Tomcat 11.0.0-M1 through 11.0.17, 10.1.0-M7 through 10.1.51, 9.0.83 through 9.0.114
- Red Hat JBoss Web Server 5, 6.2
- Red Hat Enterprise Linux 9, 10
Timeline
- 2026-02-17: advisory: Initial NVD publication date
- 2026-05-19: patched: Red Hat released security updates for RHEL 10
- 2026-06-16: patched: Red Hat released security updates for RHEL 9
References
- https://lists.apache.org/thread/292dlmx3fz1888v6v16221kpozq56gml
- https://access.redhat.com/errata/RHSA-2026:19054
- https://access.redhat.com/errata/RHSA-2026:26323
- https://access.redhat.com/errata/RHSA-2026:5611
- https://access.redhat.com/errata/RHSA-2026:5612
- https://access.redhat.com/errata/RHSA-2026:6569
- https://access.redhat.com/errata/RHSA-2026:8334