CVE-2026-24734

CVE-2026-24734 is an Improper Input Validation vulnerability affecting Apache Tomcat Native and Apache Tomcat itself. When using an OCSP responder, Tomcat Native (and the Tomcat Native FFM port) may not perform verification or freshness checks on OCSP responses, potentially allowing certificate r...

CVE-2018-8019

CVE-2018-8019 affects OCSP handling in Apache Tomcat Native. Affects Tomcat Native versions 1.2.0–1.2.16 and 1.1.23–1.1.34 where invalid OCSP responses could cause revoked client certificates to be accepted during mutual TLS authentication. Public details indicate vulnerability in OCSP response p...

CVE-2018-8020

CVE-2018-8020 affects Apache Tomcat Native 1.2.0–1.2.16 and 1.1.23–1.1.34. The flaw: OCSP pre-produced responses are not properly checked, so revoked client certificates may not be identified in mutual-TLS connections. This vulnerability is explicitly tied to OCSP checking; systems not using OCSP...