CVE-2026-29145
CVE-2026-29145 · Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled
This page contains facts from public vulnerability sources. Check the original advisory before updating.
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13. Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.
CVSS 9.1 · Critical · EPSS 0.7% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
apache tomcat
- Versions
- ≥ 11.0.0-M1, ≤ 11.0.18: Affected (semver)
- ≥ 10.1.0-M7, ≤ 10.1.52: Affected (semver)
- ≥ 9.0.83, ≤ 9.0.115: Affected (semver)
- ≥ 0, ≤ 8.5.100: Not affected (semver)
No fix published
apache tomcat native
- Versions
- ≥ 1.1.23, ≤ 1.1.34: Affected (semver)
- ≥ 1.2.0, ≤ 1.2.39: Affected (semver)
- ≥ 1.3.0, ≤ 1.3.6: Affected (semver)
- ≥ 2.0.0, ≤ 2.0.13: Affected (semver)
No fix published
tomcat10 Debian:12
- Versions
- 10.1.10-1
- 10.1.13-1
- 10.1.14-1
- 10.1.15-1
- 10.1.16-1
- 10.1.20-1
- 10.1.23-1
- 10.1.25-1
- 10.1.25-1~bpo12+1
- 10.1.25-2
- 10.1.30-1
- 10.1.30-1~bpo12+1
- 10.1.31-1
- 10.1.33-1
- 10.1.33-1~bpo12+1
- 10.1.34-0+deb12u1
- 10.1.34-0+deb12u2
- 10.1.34-1
- 10.1.35-1
- 10.1.40-1
- 10.1.40-1~bpo12+1
- 10.1.46-1
- 10.1.52-1
- 10.1.52-1~deb12u1
- 10.1.52-1~deb13u1
- 10.1.52-2
- 10.1.54-1
- 10.1.6-1
- 10.1.6-1+deb12u1
- 10.1.6-1+deb12u2
- 10.1.7-1
- 10.1.8-1
- 10.1.9-1
- Affected ranges
- ECOSYSTEM: < 10.1.55-1~deb12u1
Update to 10.1.55-1~deb12u1
tomcat10 Debian:13
- Versions
- 10.1.40-1
- 10.1.46-1
- 10.1.52-1
- 10.1.52-1~deb12u1
- 10.1.52-1~deb13u1
- 10.1.52-2
- 10.1.54-1
- 10.1.55-1~deb12u1
- Affected ranges
- ECOSYSTEM: < 10.1.55-1~deb13u1
Update to 10.1.55-1~deb13u1
tomcat10 Debian:14
- Versions
- 10.1.40-1
- 10.1.46-1
- 10.1.52-1
- 10.1.52-1~deb12u1
- 10.1.52-1~deb13u1
- 10.1.52-2
- Affected ranges
- ECOSYSTEM: < 10.1.54-1
Update to 10.1.54-1
tomcat11 Debian:13
- Versions
- 11.0.11-1
- 11.0.15-1
- 11.0.15-1~deb13u1
- 11.0.18-1
- 11.0.21-1
- 11.0.6-1
- Affected ranges
- ECOSYSTEM: < 11.0.22-1~deb13u1
Update to 11.0.22-1~deb13u1
tomcat11 Debian:14
- Versions
- 11.0.11-1
- 11.0.15-1
- 11.0.15-1~deb13u1
- 11.0.18-1
- 11.0.6-1
- Affected ranges
- ECOSYSTEM: < 11.0.21-1
Update to 11.0.21-1
tomcat9 Debian:12
- Affected ranges
- ECOSYSTEM: < 9.0.70-2
Update to 9.0.70-2
tomcat9 Debian:13
- Affected ranges
- ECOSYSTEM: < 9.0.70-2
Update to 9.0.70-2
tomcat9 Debian:14
- Affected ranges
- ECOSYSTEM: < 9.0.70-2
Update to 9.0.70-2
tomcat10 Ubuntu:24.04:LTS
- Versions
- 10.1.10-1
- 10.1.14-1
- 10.1.15-1
- 10.1.16-1
- 10.1.16-1ubuntu0.1~esm1
- 10.1.16-1ubuntu0.1~esm2
- 10.1.16-1ubuntu0.1~esm3
- 10.1.16-1ubuntu0.1~esm4
- 10.1.55-1ubuntu2~24.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat10 Ubuntu:25.10
- Versions
- 10.1.35-1
- 10.1.40-1
- 10.1.40-1ubuntu1
- 10.1.40-1ubuntu1.25.10.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat11 Ubuntu:25.10
- Versions
- 11.0.6-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat9 Ubuntu:25.10
- Versions
- 9.0.70-2ubuntu1.1
- 9.0.70-2ubuntu2
- 9.0.70-2ubuntu3
- 9.0.95-1ubuntu1
- 9.0.95-1ubuntu1.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat10 Ubuntu:26.04:LTS
- Versions
- 10.1.40-1ubuntu1
- 10.1.40-1ubuntu1.26.04.1
- 10.1.55-1ubuntu2~26.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat9 Ubuntu:26.04:LTS
- Versions
- 9.0.95-1ubuntu1
- 9.0.111-1
- 9.0.115-1
- 9.0.115-1ubuntu0.1
- 9.0.118-1~26.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat11 Ubuntu:26.04:LTS
- Versions
- 11.0.6-1
- 11.0.11-1
- 11.0.15-1
- 11.0.18-1
- 11.0.18-1ubuntu0.1~esm1
- 11.0.22-2ubuntu2~26.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published