CLEANSTART-2026-IS05941 CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native

🗓️ 23 Apr 2026 00:39:55Reported by GoogleType

osv

osv🔗 osv.dev👁 24 Views

Vulnerabilities affect thingsboard; CLIENT_CERT auth may not fail when soft fail is off in Tomcat.

Reporter	Title	Published	Views	Family All 1598
OSV	MINI-VCJ3-C6CJ-36XV	27 Mar 202617:23	–	osv
OSV	MINI-VG6G-MQRW-GMR3	13 Jun 202616:24	–	osv
OSV	MINI-VGRP-Q6F5-Q8H3	1 May 202622:45	–	osv
OSV	MINI-VHVG-FP62-RWH4	28 Apr 202613:00	–	osv
OSV	MINI-VJGJ-F6HJ-VFH3	27 Mar 202614:46	–	osv
OSV	MINI-VJXH-JMX2-HMMG	30 Apr 202616:15	–	osv
OSV	MINI-VQQJ-W2XX-R6HH	12 Apr 202613:00	–	osv
OSV	MINI-VRVG-7XXX-5963	27 Aug 202514:42	–	osv
OSV	MINI-VRVP-P9CV-Q8QQ	12 Apr 202613:45	–	osv
OSV	MINI-VWPX-6C3P-FV2P	17 Oct 202521:56	–	osv

Source	Link
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-IS05941.json
osv	www.osv.dev/vulnerability/CVE-2025-41254
osv	www.osv.dev/vulnerability/CVE-2025-66614
osv	www.osv.dev/vulnerability/CVE-2025-7962
osv	www.osv.dev/vulnerability/CVE-2025-8916
osv	www.osv.dev/vulnerability/CVE-2026-1225
osv	www.osv.dev/vulnerability/CVE-2026-22735
osv	www.osv.dev/vulnerability/CVE-2026-22737
osv	www.osv.dev/vulnerability/CVE-2026-24281
osv	www.osv.dev/vulnerability/CVE-2026-24308

23 Apr 2026 05:02Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.19.8

EPSS0.01177

thingsboard vulnerabilities client certificate authentication soft fail off apache tomcat apache tomcat native