CVE-2026-74048

CVE-2026-74048 · Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.26, from 10.1.22 through 10.1.60, from 9.0.92 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.

EPSS 0.2% · Fix available

Published: 2026-10-20T13:36:36.859Z
Updated: 2026-10-20T18:10:02.410Z

Stack: system

Affected products and versions

apache tomcat
Versions
- ≥ 11.0.0-M14, ≤ 11.0.26: Affected (semver)
- ≥ 10.1.22, ≤ 10.1.60: Affected (semver)
- ≥ 9.0.92, ≤ 9.0.122: Affected (semver)
No fix published
tomcat10 Debian:12
Versions
- 10.1.10-1
- 10.1.13-1
- 10.1.14-1
- 10.1.15-1
- 10.1.16-1
- 10.1.20-1
- 10.1.23-1
- 10.1.25-1
- 10.1.25-1~bpo12+1
- 10.1.25-2
- 10.1.30-1
- 10.1.30-1~bpo12+1
- 10.1.31-1
- 10.1.33-1
- 10.1.33-1~bpo12+1
- 10.1.34-0+deb12u1
- 10.1.34-0+deb12u2
- 10.1.34-1
- 10.1.35-1
- 10.1.40-1
- 10.1.40-1~bpo12+1
- 10.1.46-1
- 10.1.52-1
- 10.1.52-1~deb12u1
- 10.1.52-1~deb13u1
- 10.1.52-2
- 10.1.54-1
- 10.1.55-1
- 10.1.55-1~deb12u1
- 10.1.55-1~deb13u1
- 10.1.6-1
- 10.1.6-1+deb12u1
- 10.1.6-1+deb12u2
- 10.1.60-1
- 10.1.7-1
- 10.1.8-1
- 10.1.9-1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat10 Debian:13
Versions
- 10.1.40-1
- 10.1.46-1
- 10.1.52-1
- 10.1.52-1~deb12u1
- 10.1.52-1~deb13u1
- 10.1.52-2
- 10.1.54-1
- 10.1.55-1
- 10.1.55-1~deb12u1
- 10.1.55-1~deb13u1
- 10.1.60-1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat10 Debian:14
Versions
- 10.1.40-1
- 10.1.46-1
- 10.1.52-1
- 10.1.52-1~deb12u1
- 10.1.52-1~deb13u1
- 10.1.52-2
- 10.1.54-1
- 10.1.55-1
- 10.1.55-1~deb12u1
- 10.1.55-1~deb13u1
- 10.1.60-1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat11 Debian:13
Versions
- 11.0.11-1
- 11.0.15-1
- 11.0.15-1~deb13u1
- 11.0.18-1
- 11.0.21-1
- 11.0.22-1
- 11.0.22-1~deb13u1
- 11.0.22-2
- 11.0.24-1
- 11.0.6-1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat11 Debian:14
Versions
- 11.0.11-1
- 11.0.15-1
- 11.0.15-1~deb13u1
- 11.0.18-1
- 11.0.21-1
- 11.0.22-1
- 11.0.22-1~deb13u1
- 11.0.22-2
- 11.0.24-1
- 11.0.6-1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat9 Debian:12
Affected ranges
- ECOSYSTEM: < 9.0.70-2
Update to 9.0.70-2
tomcat9 Debian:13
Affected ranges
- ECOSYSTEM: < 9.0.70-2
Update to 9.0.70-2
tomcat9 Debian:14
Affected ranges
- ECOSYSTEM: < 9.0.70-2
Update to 9.0.70-2
tomcat6 Ubuntu:Pro:14.04:LTS
Versions
- 6.0.37-1
- 6.0.39-1
- 6.0.39-1ubuntu0.1
- 6.0.39-1ubuntu0.1+esm1
- 6.0.39-1ubuntu0.1+esm2
- 6.0.39-1ubuntu0.1+esm3
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat7 Ubuntu:Pro:14.04:LTS
Versions
- 7.0.42-1
- 7.0.47-1
- 7.0.50-1
- 7.0.52-1
- 7.0.52-1ubuntu0.1
- 7.0.52-1ubuntu0.3
- 7.0.52-1ubuntu0.6
- 7.0.52-1ubuntu0.7
- 7.0.52-1ubuntu0.8
- 7.0.52-1ubuntu0.9
- 7.0.52-1ubuntu0.10
- 7.0.52-1ubuntu0.11
- 7.0.52-1ubuntu0.13
- 7.0.52-1ubuntu0.14
- 7.0.52-1ubuntu0.15
- 7.0.52-1ubuntu0.16
- 7.0.52-1ubuntu0.16+esm1
- 7.0.52-1ubuntu0.16+esm2
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat8 Ubuntu:Pro:16.04:LTS
Versions
- 8.0.26-1
- 8.0.28-1
- 8.0.30-1
- 8.0.32-1
- 8.0.32-1ubuntu1
- 8.0.32-1ubuntu1.1
- 8.0.32-1ubuntu1.2
- 8.0.32-1ubuntu1.3
- 8.0.32-1ubuntu1.4
- 8.0.32-1ubuntu1.5
- 8.0.32-1ubuntu1.6
- 8.0.32-1ubuntu1.7
- 8.0.32-1ubuntu1.8
- 8.0.32-1ubuntu1.9
- 8.0.32-1ubuntu1.10
- 8.0.32-1ubuntu1.11
- 8.0.32-1ubuntu1.13
- 8.0.32-1ubuntu1.13+esm1
- 8.0.32-1ubuntu1.13+esm2
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat7 Ubuntu:Pro:16.04:LTS
Versions
- 7.0.64-1
- 7.0.68-1
- 7.0.68-1ubuntu0.1
- 7.0.68-1ubuntu0.3
- 7.0.68-1ubuntu0.4
- 7.0.68-1ubuntu0.4+esm1
- 7.0.68-1ubuntu0.4+esm2
- 7.0.68-1ubuntu0.4+esm3
- 7.0.68-1ubuntu0.4+esm4
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat8 Ubuntu:Pro:18.04:LTS
Versions
- 8.5.21-1ubuntu1
- 8.5.29-1
- 8.5.30-1
- 8.5.30-1ubuntu1
- 8.5.30-1ubuntu1.2
- 8.5.30-1ubuntu1.3
- 8.5.30-1ubuntu1.4
- 8.5.39-1ubuntu1~18.04.1
- 8.5.39-1ubuntu1~18.04.2
- 8.5.39-1ubuntu1~18.04.3
- 8.5.39-1ubuntu1~18.04.3+esm1
- 8.5.39-1ubuntu1~18.04.3+esm2
- 8.5.39-1ubuntu1~18.04.3+esm3
- 8.5.39-1ubuntu1~18.04.3+esm4
- 8.5.39-1ubuntu1~18.04.3+esm5
- 8.5.39-1ubuntu1~18.04.3+esm6
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat9 Ubuntu:Pro:18.04:LTS
Versions
- 9.0.16-3~18.04.1
- 9.0.16-3ubuntu0.18.04.1
- 9.0.16-3ubuntu0.18.04.2
- 9.0.16-3ubuntu0.18.04.2+esm1
- 9.0.16-3ubuntu0.18.04.2+esm2
- 9.0.16-3ubuntu0.18.04.2+esm3
- 9.0.16-3ubuntu0.18.04.2+esm4
- 9.0.16-3ubuntu0.18.04.2+esm5
- 9.0.16-3ubuntu0.18.04.2+esm6
- 9.0.16-3ubuntu0.18.04.2+esm7
- 9.0.16-3ubuntu0.18.04.2+esm8
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat9 Ubuntu:Pro:20.04:LTS
Versions
- 9.0.24-1
- 9.0.27-1
- 9.0.31-1
- 9.0.31-1ubuntu0.1
- 9.0.31-1ubuntu0.2
- 9.0.31-1ubuntu0.3
- 9.0.31-1ubuntu0.4
- 9.0.31-1ubuntu0.5
- 9.0.31-1ubuntu0.6
- 9.0.31-1ubuntu0.7
- 9.0.31-1ubuntu0.8
- 9.0.31-1ubuntu0.9
- 9.0.31-1ubuntu0.9+esm1
- 9.0.31-1ubuntu0.9+esm2
- 9.0.31-1ubuntu0.9+esm3
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat9 Ubuntu:Pro:22.04:LTS
Versions
- 9.0.43-3
- 9.0.54-1
- 9.0.55-1
- 9.0.58-1
- 9.0.58-1ubuntu0.1
- 9.0.58-1ubuntu0.1+esm1
- 9.0.58-1ubuntu0.1+esm2
- 9.0.58-1ubuntu0.1+esm3
- 9.0.58-1ubuntu0.1+esm4
- 9.0.58-1ubuntu0.2
- 9.0.58-1ubuntu0.2+esm1
- 9.0.58-1ubuntu0.2+esm2
- 9.0.58-1ubuntu0.2+esm3
- 9.0.58-1ubuntu0.2+esm4
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat10 Ubuntu:24.04:LTS
Versions
- 10.1.10-1
- 10.1.14-1
- 10.1.15-1
- 10.1.16-1
- 10.1.16-1ubuntu0.1~esm1
- 10.1.16-1ubuntu0.1~esm2
- 10.1.16-1ubuntu0.1~esm3
- 10.1.16-1ubuntu0.1~esm4
- 10.1.55-1ubuntu2~24.04.1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat9 Ubuntu:24.04:LTS
Versions
- 9.0.70-1ubuntu1
- 9.0.70-2
- 9.0.70-2ubuntu0.1
- 9.0.70-2ubuntu0.1+esm1
- 9.0.70-2ubuntu0.1+esm2
- 9.0.70-2ubuntu0.1+esm3
- 9.0.118-1~24.04.1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat10 Ubuntu:26.10
Versions
- 10.1.40-1ubuntu1
- 10.1.54-1
- 10.1.54-1ubuntu1
- 10.1.54-1ubuntu2
- 10.1.55-1ubuntu1
- 10.1.55-1ubuntu2
- 10.1.57~us1-0ubuntu1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat11 Ubuntu:26.10
Versions
- 11.0.18-1
- 11.0.22-2
- 11.0.22-2ubuntu1
- 11.0.22-2ubuntu2
- 11.0.24-1ubuntu1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat9 Ubuntu:26.10
Versions
- 9.0.115-1
- 9.0.115-1ubuntu1
- 9.0.118-1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat10 Ubuntu:26.04:LTS
Versions
- 10.1.40-1ubuntu1
- 10.1.40-1ubuntu1.26.04.1
- 10.1.55-1ubuntu2~26.04.1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat9 Ubuntu:26.04:LTS
Versions
- 9.0.95-1ubuntu1
- 9.0.111-1
- 9.0.115-1
- 9.0.115-1ubuntu0.1
- 9.0.118-1~26.04.1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published

Original sources

Check your server →

CVE-2026-74048 · Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up

Affected products and versions

apache tomcat

tomcat10 Debian:12

tomcat10 Debian:13

tomcat10 Debian:14

tomcat11 Debian:13

tomcat11 Debian:14

tomcat9 Debian:12

tomcat9 Debian:13

tomcat9 Debian:14

tomcat6 Ubuntu:Pro:14.04:LTS

tomcat7 Ubuntu:Pro:14.04:LTS

tomcat8 Ubuntu:Pro:16.04:LTS

tomcat7 Ubuntu:Pro:16.04:LTS

tomcat8 Ubuntu:Pro:18.04:LTS

tomcat9 Ubuntu:Pro:18.04:LTS

tomcat9 Ubuntu:Pro:20.04:LTS

tomcat9 Ubuntu:Pro:22.04:LTS

tomcat10 Ubuntu:24.04:LTS

tomcat9 Ubuntu:24.04:LTS

tomcat10 Ubuntu:26.10

tomcat11 Ubuntu:26.10

tomcat9 Ubuntu:26.10

tomcat10 Ubuntu:26.04:LTS

tomcat9 Ubuntu:26.04:LTS

Original sources