CVE-2026-74048

Apache Tomcat is vulnerable to a Not Failing Securely ('Failing Open') vulnerability. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, the system logs the error but continues to operate using JSSE in non-FIPS mode with the existing configuration. This issu...

CVE-2026-74048 Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up

Not Failing Securely 'Failing Open' vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration. This issue affects Apache Tomcat: from...

EUVD-2026-105004

Not Failing Securely 'Failing Open' vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration. This issue affects Apache Tomcat: from...

CVE-2026-74048

Not Failing Securely 'Failing Open' vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration. This issue affects Apache Tomcat: from...

tomcat: Tomcat: Cryptographic policy bypass via FIPS activation failure

A flaw was found in Apache Tomcat. When the server is configured to enforce FIPS Federal Information Processing Standards mode, a failure during FIPS activation causes Tomcat to log an error and continue running with standard non-FIPS cryptographic providers instead of terminating securely. This...

CLEANSTART-2026-XA48515 Security fix for GHSA-f6x5-jh6r-wrfv applied in: gatekeeper-fips 3.20.1-r0

Security vulnerability affects the gatekeeper-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-XF34954 Security fix for GHSA-j5w8-q4qc-rx2x applied in: gatekeeper-fips 3.20.1-r0

Security vulnerability affects the gatekeeper-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-JU41154 NewNTUnicodeString does not check for string length overflow

Security vulnerability affects the gatekeeper-fips package. NewNTUnicodeString does not check for string length overflow...

CLEANSTART-2026-CY18985 Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service

Security vulnerability affects the gatekeeper-fips package. Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service...

CLEANSTART-2026-XV49388 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

Security vulnerability affects the gatekeeper-fips package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...

CLEANSTART-2026-OY76319 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

Security vulnerability affects the gatekeeper-fips package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...

CLEANSTART-2026-GT62357 Security fix for GHSA-gcjh-h69q-9w9g applied in: gatekeeper-fips 3.22.0-r0

Security vulnerability affects the gatekeeper-fips package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-II66740 containerd is an open-source container runtime

Security vulnerability affects the gatekeeper-fips package. containerd is an open-source container runtime...

CLEANSTART-2026-RF47243 containerd is an open-source container runtime

Security vulnerability affects the gatekeeper-fips package. containerd is an open-source container runtime...

CLEANSTART-2026-GW76003 containerd is an open-source container runtime

Security vulnerability affects the gatekeeper-fips package. containerd is an open-source container runtime...

CLEANSTART-2026-NV54343 containerd is an open-source container runtime

Security vulnerability affects the gatekeeper-fips package. containerd is an open-source container runtime...

CLEANSTART-2026-GA67495 containerd is an open-source container runtime

Security vulnerability affects the gatekeeper-fips package. containerd is an open-source container runtime...

CLEANSTART-2026-MI18289 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Security vulnerability affects the gatekeeper-fips package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...

CLEANSTART-2026-XD72038 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

Security vulnerability affects the gatekeeper-fips package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...

CLEANSTART-2026-IB35002 Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

Security vulnerability affects the gatekeeper-fips package. Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree...