CVE-2026-86248

CVE-2026-86248 · Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from 10.1.22 through 10.1.59, from 9.0.92 through 9.0.121. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.

CVSS 9.8 · Critical · EPSS 0.4% · Fix available

Published: 2026-09-23T11:29:35.479Z
Updated: 2026-09-23T16:14:59.897Z

Stack: system

Affected products and versions

apache tomcat
Versions
- ≥ 11.0.0-M14, ≤ 11.0.25: Affected (semver)
- ≥ 10.1.22, ≤ 10.1.59: Affected (semver)
- ≥ 9.0.92, ≤ 9.0.121: Affected (semver)
No fix published
tomcat10 Debian:12
Versions
- 10.1.10-1
- 10.1.13-1
- 10.1.14-1
- 10.1.15-1
- 10.1.16-1
- 10.1.20-1
- 10.1.23-1
- 10.1.25-1
- 10.1.25-1~bpo12+1
- 10.1.25-2
- 10.1.30-1
- 10.1.30-1~bpo12+1
- 10.1.31-1
- 10.1.33-1
- 10.1.33-1~bpo12+1
- 10.1.34-0+deb12u1
- 10.1.34-0+deb12u2
- 10.1.34-1
- 10.1.35-1
- 10.1.40-1
- 10.1.40-1~bpo12+1
- 10.1.46-1
- 10.1.52-1
- 10.1.52-1~deb12u1
- 10.1.52-1~deb13u1
- 10.1.52-2
- 10.1.54-1
- 10.1.55-1
- 10.1.55-1~deb12u1
- 10.1.55-1~deb13u1
- 10.1.6-1
- 10.1.6-1+deb12u1
- 10.1.6-1+deb12u2
- 10.1.60-1
- 10.1.7-1
- 10.1.8-1
- 10.1.9-1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat10 Debian:13
Versions
- 10.1.40-1
- 10.1.46-1
- 10.1.52-1
- 10.1.52-1~deb12u1
- 10.1.52-1~deb13u1
- 10.1.52-2
- 10.1.54-1
- 10.1.55-1
- 10.1.55-1~deb12u1
- 10.1.55-1~deb13u1
- 10.1.60-1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat10 Debian:14
Versions
- 10.1.40-1
- 10.1.46-1
- 10.1.52-1
- 10.1.52-1~deb12u1
- 10.1.52-1~deb13u1
- 10.1.52-2
- 10.1.54-1
- 10.1.55-1
- 10.1.55-1~deb12u1
- 10.1.55-1~deb13u1
Affected ranges
- ECOSYSTEM: < 10.1.60-1
Update to 10.1.60-1
tomcat11 Debian:13
Versions
- 11.0.11-1
- 11.0.15-1
- 11.0.15-1~deb13u1
- 11.0.18-1
- 11.0.21-1
- 11.0.22-1
- 11.0.22-1~deb13u1
- 11.0.22-2
- 11.0.24-1
- 11.0.6-1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat11 Debian:14
Versions
- 11.0.11-1
- 11.0.15-1
- 11.0.15-1~deb13u1
- 11.0.18-1
- 11.0.21-1
- 11.0.22-1
- 11.0.22-1~deb13u1
- 11.0.22-2
- 11.0.24-1
- 11.0.6-1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat9 Debian:12
Affected ranges
- ECOSYSTEM: < 9.0.70-2
Update to 9.0.70-2
tomcat9 Debian:13
Affected ranges
- ECOSYSTEM: < 9.0.70-2
Update to 9.0.70-2
tomcat9 Debian:14
Affected ranges
- ECOSYSTEM: < 9.0.70-2
Update to 9.0.70-2
tomcat6 Ubuntu:Pro:14.04:LTS
Versions
- 6.0.37-1
- 6.0.39-1
- 6.0.39-1ubuntu0.1
- 6.0.39-1ubuntu0.1+esm1
- 6.0.39-1ubuntu0.1+esm2
- 6.0.39-1ubuntu0.1+esm3
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat7 Ubuntu:Pro:14.04:LTS
Versions
- 7.0.42-1
- 7.0.47-1
- 7.0.50-1
- 7.0.52-1
- 7.0.52-1ubuntu0.1
- 7.0.52-1ubuntu0.3
- 7.0.52-1ubuntu0.6
- 7.0.52-1ubuntu0.7
- 7.0.52-1ubuntu0.8
- 7.0.52-1ubuntu0.9
- 7.0.52-1ubuntu0.10
- 7.0.52-1ubuntu0.11
- 7.0.52-1ubuntu0.13
- 7.0.52-1ubuntu0.14
- 7.0.52-1ubuntu0.15
- 7.0.52-1ubuntu0.16
- 7.0.52-1ubuntu0.16+esm1
- 7.0.52-1ubuntu0.16+esm2
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat8 Ubuntu:Pro:16.04:LTS
Versions
- 8.0.26-1
- 8.0.28-1
- 8.0.30-1
- 8.0.32-1
- 8.0.32-1ubuntu1
- 8.0.32-1ubuntu1.1
- 8.0.32-1ubuntu1.2
- 8.0.32-1ubuntu1.3
- 8.0.32-1ubuntu1.4
- 8.0.32-1ubuntu1.5
- 8.0.32-1ubuntu1.6
- 8.0.32-1ubuntu1.7
- 8.0.32-1ubuntu1.8
- 8.0.32-1ubuntu1.9
- 8.0.32-1ubuntu1.10
- 8.0.32-1ubuntu1.11
- 8.0.32-1ubuntu1.13
- 8.0.32-1ubuntu1.13+esm1
- 8.0.32-1ubuntu1.13+esm2
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat7 Ubuntu:Pro:16.04:LTS
Versions
- 7.0.64-1
- 7.0.68-1
- 7.0.68-1ubuntu0.1
- 7.0.68-1ubuntu0.3
- 7.0.68-1ubuntu0.4
- 7.0.68-1ubuntu0.4+esm1
- 7.0.68-1ubuntu0.4+esm2
- 7.0.68-1ubuntu0.4+esm3
- 7.0.68-1ubuntu0.4+esm4
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat8 Ubuntu:Pro:18.04:LTS
Versions
- 8.5.21-1ubuntu1
- 8.5.29-1
- 8.5.30-1
- 8.5.30-1ubuntu1
- 8.5.30-1ubuntu1.2
- 8.5.30-1ubuntu1.3
- 8.5.30-1ubuntu1.4
- 8.5.39-1ubuntu1~18.04.1
- 8.5.39-1ubuntu1~18.04.2
- 8.5.39-1ubuntu1~18.04.3
- 8.5.39-1ubuntu1~18.04.3+esm1
- 8.5.39-1ubuntu1~18.04.3+esm2
- 8.5.39-1ubuntu1~18.04.3+esm3
- 8.5.39-1ubuntu1~18.04.3+esm4
- 8.5.39-1ubuntu1~18.04.3+esm5
- 8.5.39-1ubuntu1~18.04.3+esm6
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat9 Ubuntu:Pro:18.04:LTS
Versions
- 9.0.16-3~18.04.1
- 9.0.16-3ubuntu0.18.04.1
- 9.0.16-3ubuntu0.18.04.2
- 9.0.16-3ubuntu0.18.04.2+esm1
- 9.0.16-3ubuntu0.18.04.2+esm2
- 9.0.16-3ubuntu0.18.04.2+esm3
- 9.0.16-3ubuntu0.18.04.2+esm4
- 9.0.16-3ubuntu0.18.04.2+esm5
- 9.0.16-3ubuntu0.18.04.2+esm6
- 9.0.16-3ubuntu0.18.04.2+esm7
- 9.0.16-3ubuntu0.18.04.2+esm8
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat9 Ubuntu:Pro:20.04:LTS
Versions
- 9.0.24-1
- 9.0.27-1
- 9.0.31-1
- 9.0.31-1ubuntu0.1
- 9.0.31-1ubuntu0.2
- 9.0.31-1ubuntu0.3
- 9.0.31-1ubuntu0.4
- 9.0.31-1ubuntu0.5
- 9.0.31-1ubuntu0.6
- 9.0.31-1ubuntu0.7
- 9.0.31-1ubuntu0.8
- 9.0.31-1ubuntu0.9
- 9.0.31-1ubuntu0.9+esm1
- 9.0.31-1ubuntu0.9+esm2
- 9.0.31-1ubuntu0.9+esm3
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat9 Ubuntu:Pro:22.04:LTS
Versions
- 9.0.43-3
- 9.0.54-1
- 9.0.55-1
- 9.0.58-1
- 9.0.58-1ubuntu0.1
- 9.0.58-1ubuntu0.1+esm1
- 9.0.58-1ubuntu0.1+esm2
- 9.0.58-1ubuntu0.1+esm3
- 9.0.58-1ubuntu0.1+esm4
- 9.0.58-1ubuntu0.2
- 9.0.58-1ubuntu0.2+esm1
- 9.0.58-1ubuntu0.2+esm2
- 9.0.58-1ubuntu0.2+esm3
- 9.0.58-1ubuntu0.2+esm4
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat10 Ubuntu:24.04:LTS
Versions
- 10.1.10-1
- 10.1.14-1
- 10.1.15-1
- 10.1.16-1
- 10.1.16-1ubuntu0.1~esm1
- 10.1.16-1ubuntu0.1~esm2
- 10.1.16-1ubuntu0.1~esm3
- 10.1.16-1ubuntu0.1~esm4
- 10.1.55-1ubuntu2~24.04.1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat9 Ubuntu:24.04:LTS
Versions
- 9.0.70-1ubuntu1
- 9.0.70-2
- 9.0.70-2ubuntu0.1
- 9.0.70-2ubuntu0.1+esm1
- 9.0.70-2ubuntu0.1+esm2
- 9.0.70-2ubuntu0.1+esm3
- 9.0.118-1~24.04.1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat10 Ubuntu:26.10
Versions
- 10.1.40-1ubuntu1
- 10.1.54-1
- 10.1.54-1ubuntu1
- 10.1.54-1ubuntu2
- 10.1.55-1ubuntu1
- 10.1.55-1ubuntu2
- 10.1.57~us1-0ubuntu1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat11 Ubuntu:26.10
Versions
- 11.0.18-1
- 11.0.22-2
- 11.0.22-2ubuntu1
- 11.0.22-2ubuntu2
- 11.0.24-1ubuntu1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat9 Ubuntu:26.10
Versions
- 9.0.115-1
- 9.0.115-1ubuntu1
- 9.0.118-1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat10 Ubuntu:26.04:LTS
Versions
- 10.1.40-1ubuntu1
- 10.1.40-1ubuntu1.26.04.1
- 10.1.55-1ubuntu2~26.04.1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
tomcat9 Ubuntu:26.04:LTS
Versions
- 9.0.95-1ubuntu1
- 9.0.111-1
- 9.0.115-1
- 9.0.115-1ubuntu0.1
- 9.0.118-1~26.04.1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published

Original sources

Check your server →

CVE-2026-86248 · Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled

Affected products and versions

apache tomcat

tomcat10 Debian:12

tomcat10 Debian:13

tomcat10 Debian:14

tomcat11 Debian:13

tomcat11 Debian:14

tomcat9 Debian:12

tomcat9 Debian:13

tomcat9 Debian:14

tomcat6 Ubuntu:Pro:14.04:LTS

tomcat7 Ubuntu:Pro:14.04:LTS

tomcat8 Ubuntu:Pro:16.04:LTS

tomcat7 Ubuntu:Pro:16.04:LTS

tomcat8 Ubuntu:Pro:18.04:LTS

tomcat9 Ubuntu:Pro:18.04:LTS

tomcat9 Ubuntu:Pro:20.04:LTS

tomcat9 Ubuntu:Pro:22.04:LTS

tomcat10 Ubuntu:24.04:LTS

tomcat9 Ubuntu:24.04:LTS

tomcat10 Ubuntu:26.10

tomcat11 Ubuntu:26.10

tomcat9 Ubuntu:26.10

tomcat10 Ubuntu:26.04:LTS

tomcat9 Ubuntu:26.04:LTS

Original sources