Junglewise Threat Intelligence

CVE-2026-24734: Apache Tomcat certificate revocation bypass in OCSP validation

CVE-2026-24734 · Severity: high · CVSS 7.5 · Published 2026-02-17

Technologies: Apache Tomcat, Red Hat Enterprise Linux. Vendors: Red Hat, Apache, Apache Software Foundation.

Executive brief

Apache Tomcat, a widely used web server for Java applications, contains a security flaw in how it verifies digital certificates. When checking if a certificate has been cancelled (revoked), the system fails to properly validate the response from the verification service. This could allow an attacker to use a stolen or invalid certificate to gain unauthorized access to secure systems, potentially compromising sensitive data or operations.

Technical details

An improper input validation vulnerability exists in Apache Tomcat Native and the FFM port of Tomcat Native code. The flaw occurs during the processing of Online Certificate Status Protocol (OCSP) responses, where the software fails to complete necessary verification or freshness checks. A remote, unauthenticated attacker can exploit this by providing a specially crafted or stale OCSP response, effectively bypassing certificate revocation lists. This allows the use of revoked certificates for TLS authentication. Patches are available in Tomcat versions 11.0.18, 10.1.52, and 9.0.115, and Tomcat Native versions 1.3.5 and 2.0.12.

Affected products

  • Apache Tomcat Native 1.3.0 through 1.3.4, 2.0.0 through 2.0.11, 1.1.23 through 1.1.34, 1.2.0 through 1.2.39
  • Apache Tomcat 11.0.0-M1 through 11.0.17, 10.1.0-M7 through 10.1.51, 9.0.83 through 9.0.114
  • Red Hat JBoss Web Server 5, 6.2
  • Red Hat Enterprise Linux 9, 10

Timeline

  • 2026-02-17: advisory: Initial NVD publication date
  • 2026-05-19: patched: Red Hat released security updates for RHEL 10
  • 2026-06-16: patched: Red Hat released security updates for RHEL 9

References

Related threats