CVE-2026-53434

Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118. Users are recommended to upgrade to version...

CVE-2026-53434: Detection of Error Condition Without Action

Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118. Users are recommended to upgrade to version...

tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation

A flaw was found in Apache Tomcat. When an Online Certificate Status Protocol OCSP responder is used, the Tomcat Native component, and Tomcat's FFM port of the Tomcat Native code, does not properly verify or check the freshness of the OCSP response. This improper input validation vulnerability...

MGASA-2026-0095 Updated tomcat packages fix security vulnerabilities

Request smuggling via invalid chunk extension. CVE-2026-24880 Occasionally open redirect. CVE-2026-25854 TLS cipher order is not preserved. CVE-2026-29129 OCSP checks sometimes soft-fail even when soft-fail is disabled. CVE-2026-29145 EncryptInterceptor vulnerable to padding oracle attack by...

org.apache.tomee.bom:tomee-microprofile (>=10.0.0-m3, <=10.0.0), org.apache.tomee.bom:tomee-plume (>=10.0.0-m3, <=10.0.0) +2 more potentially affected by CVE-2026-34500 via org.apache.tomcat:tomcat-coyote-ffm (>=10.1.30, <=10.1.52)

org.apache.tomcat:tomcat-coyote-ffm MAVEN version =10.1.30, =10.0.0-m3, =10.0.0-m3, =10.0.0-m3, =10.0.0-m3, =10.1.4 Source cves: CVE-2026-34500 Source advisory: OSV:GHSA-24J9-X2WG-9QV6...

org.apache.tomee.bom:tomee-microprofile (>=10.0.0-m3, <=10.0.0), org.apache.tomee.bom:tomee-plume (>=10.0.0-m3, <=10.0.0) +2 more potentially affected by CVE-2026-34500 via org.apache.tomcat:tomcat-coyote-ffm (>=10.1.30, <=10.1.52)

org.apache.tomcat:tomcat-coyote-ffm MAVEN version =10.1.30, =10.0.0-m3, =10.0.0-m3, =10.0.0-m3, =10.0.0-m3, =10.1.4 Source cves: CVE-2026-34500 Source advisory: GHSA-24J9-X2WG-9QV6...

com.github.waffle:waffle-tomcat9 (3.6.0), io.ktor:ktor-server-tomcat-jvm (>=3.4.0, <=3.4.3) +19 more potentially affected by CVE-2026-32990 via org.apache.tomcat:tomcat-coyote (>=9.0.113, <=9.0.115)

org.apache.tomcat:tomcat-coyote MAVEN version =9.0.113, =3.4.0, =9.0.113, =9.0.113, =9.0.113, =9.0.113, =1.89.0, =1.89.0, =1.89.0, =1.89.0, =1.89.0, =1.89.0, =1.90.0 and more Source cves: CVE-2026-32990 Source advisory: GHSA-8MC5-53M5-3QJ2...

org.apache.tomee.bom:tomee-microprofile (>=10.0.0-m3, <=10.0.0), org.apache.tomee.bom:tomee-plume (>=10.0.0-m3, <=10.0.0) +2 more potentially affected by CVE-2026-29145 via org.apache.tomcat:tomcat-coyote-ffm (>=10.1.30, <=10.1.52)

org.apache.tomcat:tomcat-coyote-ffm MAVEN version =10.1.30, =10.0.0-m3, =10.0.0-m3, =10.0.0-m3, =10.0.0-m3, =10.1.4 Source cves: CVE-2026-29145 Source advisory: OSV:GHSA-95JQ-RWVF-VJX4...

org.apache.tomee.bom:tomee-microprofile (>=10.0.0-m3, <=10.0.0), org.apache.tomee.bom:tomee-plume (>=10.0.0-m3, <=10.0.0) +2 more potentially affected by CVE-2026-29145 via org.apache.tomcat:tomcat-coyote-ffm (>=10.1.30, <=10.1.52)

org.apache.tomcat:tomcat-coyote-ffm MAVEN version =10.1.30, =10.0.0-m3, =10.0.0-m3, =10.0.0-m3, =10.0.0-m3, =10.1.4 Source cves: CVE-2026-29145 Source advisory: MEND:CVE-2026-29145...

CVE-2026-34500: Improper Authentication

CLIENTCERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116. Users are recommended to upgrade to...

com.github.psi-probe:psi-probe-tomcat11 (>=5.0.0, <=5.1.0), com.github.waffle:waffle-tomcat11 (3.4.0) +4 more potentially affected by CVE-2026-34500 via org.apache.tomcat:tomcat-coyote (>=11.0.0-m14, <=11.0.0-m22)

org.apache.tomcat:tomcat-coyote MAVEN version =11.0.0-m14, =5.0.0, =11.0.0-m14, =11.0.0-m14, =11.0.0-m14, =11.0.0-m22 Source cves: CVE-2026-34500 Source advisory: SNYK:JAVA-ORGAPACHETOMCAT-15989818...

com.github.psi-probe:psi-probe-tomcat11 (>=5.0.0, <=5.1.0), com.github.waffle:waffle-tomcat11 (3.4.0) +4 more potentially affected by CVE-2026-29145 via org.apache.tomcat:tomcat-coyote (>=11.0.0-m1, <=11.0.0-m22)

org.apache.tomcat:tomcat-coyote MAVEN version =11.0.0-m1, =5.0.0, =11.0.0-m1, =11.0.0-m1, =11.0.0-m1, =11.0.0-m22 Source cves: CVE-2026-29145 Source advisory: SNYK:JAVA-ORGAPACHETOMCAT-15989810...

org.apache.tomee.bom:tomee-microprofile (>=10.0.0-m3, <=10.0.0), org.apache.tomee.bom:tomee-plume (>=10.0.0-m3, <=10.0.0) +2 more potentially affected by CVE-2026-34500 via org.apache.tomcat:tomcat-coyote-ffm (>=10.1.30, <=10.1.52)

org.apache.tomcat:tomcat-coyote-ffm MAVEN version =10.1.30, =10.0.0-m3, =10.0.0-m3, =10.0.0-m3, =10.0.0-m3, =10.1.4 Source cves: CVE-2026-34500 Source advisory: SNYK:JAVA-ORGAPACHETOMCAT-15989819...

CVE-2026-24734

A flaw was found in Apache Tomcat. When an Online Certificate Status Protocol OCSP responder is used, the Tomcat Native component, and Tomcat's FFM port of the Tomcat Native code, does not properly verify or check the freshness of the OCSP response. This improper input validation vulnerability...

org.apache.tomee.bom:tomee-microprofile (>=10.0.0-m3, <=10.0.0), org.apache.tomee.bom:tomee-plume (>=10.0.0-m3, <=10.0.0) +2 more potentially affected by CVE-2026-24734 via org.apache.tomcat:tomcat-coyote-ffm (>=10.1.30, <=10.1.49)

org.apache.tomcat:tomcat-coyote-ffm MAVEN version =10.1.30, =10.0.0-m3, =10.0.0-m3, =10.0.0-m3, =10.0.0-m3, =10.1.3 Source cves: CVE-2026-24734 Source advisory: MEND:CVE-2026-24734...

org.apache.tomee.bom:tomee-microprofile (>=10.0.0-m3, <=10.0.0), org.apache.tomee.bom:tomee-plume (>=10.0.0-m3, <=10.0.0) +2 more potentially affected by CVE-2026-24734 via org.apache.tomcat:tomcat-coyote-ffm (>=10.1.30, <=10.1.49)

org.apache.tomcat:tomcat-coyote-ffm MAVEN version =10.1.30, =10.0.0-m3, =10.0.0-m3, =10.0.0-m3, =10.0.0-m3, =10.1.3 Source cves: CVE-2026-24734 Source advisory: SNYK:JAVA-ORGAPACHETOMCAT-15307823...

Fixed in Apache Tomcat 10.1.52

Moderate: Incomplete OCSP verification checks CVE-2026-24734 When using an OCSP responder, Tomcat's FFM integration with OpenSSL did not complete verification or freshness checks on the OCSP response which could allow certificate revocation to be bypassed. Affects: 10.1.0-M7 to 10.1.51 This issue...

Fixed in Apache Tomcat 9.0.115

Moderate: Incomplete OCSP verification checks CVE-2026-24734 When using an OCSP responder, Tomcat's FFM integration with OpenSSL did not complete verification or freshness checks on the OCSP response which could allow certificate revocation to be bypassed. Affects: 9.0.83 to 9.0.114 This issue wa...

FFM (Freedom Fighting Mode) - Open Source Hacking Harness

FFM is a hacking harness that you can use during the post-exploitation phase of a red-teaming engagement. The idea of the tool was derived from a 2007 conference from @thegrugq. It was presented at SSTIC 2018 and the accompanying slide deck is available at this url. If you're not familiar with th...

CVE-2007-6519

Unspecified vulnerability in the File-on-File Mounting File System FFM in HP Tru64 UNIX 5.1B-4 and 5.1B-3 allows local users to cause a denial of service system crash via unspecified vectors...