Executive brief
Apache Tomcat is a widely used web server for hosting Java applications. A security issue has been identified where the server may fail to properly reject invalid or missing client certificates during the login process when specific modern memory management features are enabled. This could allow unauthorized users to bypass security checks and gain access to protected web resources.
Technical details
An improper authentication vulnerability (CWE-287) exists in Apache Tomcat's CLIENT_CERT authentication mechanism. When the Foreign Function & Memory (FFM) API is utilized and 'soft fail' is disabled, the authentication process may fail to correctly enforce certificate requirements in certain scenarios. This could allow a remote attacker to bypass certificate-based authentication. The issue is specific to the tomcat-coyote-ffm component and requires a high attack complexity due to the specific configuration requirements. Patches are available in versions 9.0.117, 10.1.54, and 11.0.21.
Affected products
- Apache Tomcat 9.0.92 to 9.0.116, 10.1.22 to 10.1.53, 11.0.0-M14 to 11.0.20
Timeline
- 2026-04-09: disclosed
- 2026-04-09: advisory
- 2026-04-09: patched