CVE-2026-24734

CVE-2026-24734 is an Improper Input Validation vulnerability affecting Apache Tomcat Native and Apache Tomcat itself. When using an OCSP responder, Tomcat Native (and the Tomcat Native FFM port) may not perform verification or freshness checks on OCSP responses, potentially allowing certificate r...

CVE-2026-29145

The Apache Tomcat and Apache Tomcat Native servers are vulnerable to a flaw where CLIENT_CERT authentication fails to behave as expected in specific scenarios when soft fail is disabled. This issue affects Apache Tomcat versions 11.0.0-M1 through 11.0.18, 10.1.0-M7 through 10.1.52, and 9.0.83 thr...

CVE-2017-15698

CVE-2017-15698 affects the Apache Tomcat Native Connector (tomcat-native library). It arises from improper handling of AIA-Extension fields longer than 127 bytes, causing the OCSP check to be skipped and potentially allowing invalid client certificates to be accepted. Confirmed fixes appear in up...

CVE-2018-8019

CVE-2018-8019 affects OCSP handling in Apache Tomcat Native. Affects Tomcat Native versions 1.2.0–1.2.16 and 1.1.23–1.1.34 where invalid OCSP responses could cause revoked client certificates to be accepted during mutual TLS authentication. Public details indicate vulnerability in OCSP response p...

CVE-2018-8020

CVE-2018-8020 affects Apache Tomcat Native 1.2.0–1.2.16 and 1.1.23–1.1.34. The flaw: OCSP pre-produced responses are not properly checked, so revoked client certificates may not be identified in mutual-TLS connections. This vulnerability is explicitly tied to OCSP checking; systems not using OCSP...

CVE-2026-86247

A race condition within a thread in Apache Tomcat Native allows client certificate verification requirements to be down-graded for certain configurations. This vulnerability affects versions 2.0.0 through 2.0.15 and 1.3.0 through 1.3.8 , with unsupported versions potentially impacted. To remediat...

CVE-2026-86246

Apache Tomcat Native (versions 1.3.0 through 1.3.8 and 2.0.0 through 2.0.15) is vulnerable to an insecure default configuration where several risky OpenSSL options are enabled by default. These options include ALLOW_CLIENT_RENEGOTIATION , NO_EXTENDED_MASTER_SECRET , IGNORE_UNEXPECTED_EOF , and AL...

CVE-2026-86243

A buffer over-read vulnerability exists in Apache Tomcat Native during the TLS handshake , which can allow a malicious user to trigger a Denial of Service (DoS) by causing a JVM crash . This vulnerability affects versions 1.3.0 through 1.3.8 and 2.0.0 through 2.0.15 , though earlier unsupported v...