Fixed in Apache Tomcat 9.0.117

Moderate: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled CVE-2026-34500 CLIENTCERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used. This was fixed with commit ff589ab2. This issue was reported to the Tomcat security...

PT-2026-31714

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M14 through 11.0.20, versions 10.1.22 through 10.1.53, and versions 9.0.92 through 9.0.116 Description CLIENT CERT authentication may not fail as expected in certain scenarios when soft fail is disabled and FFM is...

PT-2026-31699

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 9.0.83 through 9.0.115 Apache Tomcat versions 10.1.0-M7 through 10.1.52 Apache Tomcat versions 11.0.0-M1 through 11.0.18 Apache Tomcat Native versions 1.1.23 through 1.1.34 Apache Tomcat Native versions 1.2.0 through...