Is CVE-2026-34500 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34500 being exploited in the wild.

How severe is CVE-2026-34500?

Medium severity, with a CVSS score of 6.5, published 9 April 2026.

Which products and versions are affected?

Apache Tomcat 11.0.0-M14 through 11.0.20, 10.1.22 through 10.1.53, 9.0.92 through 9.0.116, 9.0.92 to 9.0.116, 10.1.22 to 10.1.53, 11.0.0-M14 to 11.0.20; org.apache.tomcat:tomcat-coyote-ffm (Maven) ECOSYSTEM:introduced=9.0.92,fixed=9.0.117.

Is there a fix for CVE-2026-34500?

Yes. org.apache.tomcat:tomcat-coyote-ffm (Maven): upgrade to 9.0.117 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34500 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-34500?

Check whether you run Apache Tomcat or org.apache.tomcat:tomcat-coyote-ffm (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34500: Apache Tomcat improper authentication in CLIENT_CERT using FFM

CVE-2026-34500 · Severity: medium · CVSS 6.5 · Published 2026-04-09

Apache Tomcat is a widely used web server for hosting Java applications. A security issue has been identified where the server may fail to properly reject invalid or missing client certificates during the login process when specific modern memory management features are enabled. This could allow unauthorized users to bypass security checks and gain access to protected web resources.

Technologies: Apache Tomcat, org.apache.tomcat:tomcat-coyote-ffm (Maven). Vendors: Apache, Maven.

Quick answers

Is CVE-2026-34500 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34500 being exploited in the wild.
How severe is CVE-2026-34500?: Medium severity, with a CVSS score of 6.5, published 9 April 2026.
Which products and versions are affected?: Apache Tomcat 11.0.0-M14 through 11.0.20, 10.1.22 through 10.1.53, 9.0.92 through 9.0.116, 9.0.92 to 9.0.116, 10.1.22 to 10.1.53, 11.0.0-M14 to 11.0.20; org.apache.tomcat:tomcat-coyote-ffm (Maven) ECOSYSTEM:introduced=9.0.92,fixed=9.0.117.
Is there a fix for CVE-2026-34500?: Yes. org.apache.tomcat:tomcat-coyote-ffm (Maven): upgrade to 9.0.117 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34500 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-34500?: Check whether you run Apache Tomcat or org.apache.tomcat:tomcat-coyote-ffm (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.apache.tomcat:tomcat-coyote-ffm (Maven): upgrade to 9.0.117 or later

# set org.apache.tomcat:tomcat-coyote-ffm to 9.0.117 in your pom.xml or build.gradle

Technical details

An improper authentication vulnerability (CWE-287) exists in Apache Tomcat's CLIENT_CERT authentication mechanism. When the Foreign Function & Memory (FFM) API is utilized and 'soft fail' is disabled, the authentication process may fail to correctly enforce certificate requirements in certain scenarios. This could allow a remote attacker to bypass certificate-based authentication. The issue is specific to the tomcat-coyote-ffm component and requires a high attack complexity due to the specific configuration requirements. Patches are available in versions 9.0.117, 10.1.54, and 11.0.21.

Affected products

Apache Tomcat 9.0.92 to 9.0.116, 10.1.22 to 10.1.53, 11.0.0-M14 to 11.0.20

Identifiers

CVE-2026-34500
GHSA-24j9-x2wg-9qv6

Timeline

2026-04-09: disclosed
2026-04-09: advisory
2026-04-09: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.