CVE-2026-24734

Apache Tomcat Native, Apache Tomcat: OCSP revocation bypass

HIGH

7.5

CVSS Score

Published: February 17, 2026 at 06:53 PM UTC

Updated: July 15, 2026 at 02:44 PM UTC

4 products affected across 2 vendorsTomcatTomcat NativeEnterprise Linux

Using Apache Tomcat Native by Apache Software Foundation?

Get instant alerts when new vulnerabilities affect Apache Tomcat Native - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.5

Exploit prediction

EPSS 0.6%

SSVC

No known exploit

Description

Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification or freshness checks on the OCSP response which could allow certificate revocation to be bypassed. This issue affects Apache Tomcat Native: from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11; Apache Tomcat: from 11.0.0-M1 through 11.0.17, from 10.1.0-M7 through 10.1.51, from 9.0.83 through 9.0.114. The following versions were EOL at the time the CVE was created but are known to be affected: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39. Older EOL versions are not affected. Apache Tomcat Native users are recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which fix the issue. Apache Tomcat users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115 or later which fix the issue.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Tomcat · Apache

95%

10.1.0-M7 ≤ v ≤ 10.1.5110.1.1 ≤ v < 10.1.5211.0.0-M1 ≤ v ≤ 11.0.1711.0.1 ≤ v < 11.0.189.0.83 ≤ v ≤ 9.0.1149.0.83 ≤ v < 9.0.11510.1.0 milestone1 10.1.0 milestone10 10.1.0 milestone11 10.1.0 milestone12 10.1.0 milestone13 10.1.0 milestone14 10.1.0 milestone15 10.1.0 milestone16 10.1.0 milestone17 10.1.0 milestone18 10.1.0 milestone19 10.1.0 milestone2 10.1.0 milestone20 10.1.0 milestone3 10.1.0 milestone4 10.1.0 milestone5 10.1.0 milestone6 10.1.0 milestone7 10.1.0 milestone8 10.1.0 milestone9 10.1.0-M7 11.0.0 milestone1 11.0.0 milestone10 11.0.0 milestone11 11.0.0 milestone12 11.0.0 milestone13 11.0.0 milestone14 11.0.0 milestone15 11.0.0 milestone16 11.0.0 milestone17 11.0.0 milestone18 11.0.0 milestone19 11.0.0 milestone2 11.0.0 milestone20 11.0.0 milestone21 11.0.0 milestone22 11.0.0 milestone23 11.0.0 milestone24 11.0.0 milestone25 11.0.0 milestone26 11.0.0 milestone3 11.0.0 milestone4 11.0.0 milestone5 11.0.0 milestone6 11.0.0 milestone7 11.0.0 milestone8 11.0.0 milestone9 11.0.0-M1 9.0.83

Affected range stops below 10.1.52, so it looks safe — our inference, not a vendor statement

Affected range stops below 11.0.18, so it looks safe — our inference, not a vendor statement

Vendor states this is fixed in 8.5.100 (unaffected)

Affected range stops below 9.0.115, so it looks safe — our inference, not a vendor statement

Tomcat Native · Apache

95%

1.1.23 ≤ v ≤ 1.1.341.2.0 ≤ v ≤ 1.2.391.3.0 ≤ v ≤ 1.3.41.3.0 ≤ v < 1.3.52.0.0 ≤ v ≤ 2.0.112.0.0 ≤ v < 2.0.121.1.23 1.2.0 1.3.0 2.0.0

Affected range stops below 1.3.5, so it looks safe — our inference, not a vendor statement

Affected range stops below 2.0.12, so it looks safe — our inference, not a vendor statement

Enterprise Linux · Red Hatrpm

60%

Vendor states this is fixed in 1:10.1.49-1.el10_2.1 (unaffected)

Vendor states this is fixed in 1:9.0.117-1.el9_8 (unaffected)

Vendor states this is fixed in 6 (unaffected)

Vendor states this is fixed in 7 (unaffected)

Vendor states this is fixed in 8 (unaffected)

JBoss Web Server · Red Hat

60%

Vendor states this is fixed in 0:1.3.6-1.redhat_1.el10jws (unaffected)

Vendor states this is fixed in 0:1.3.6-1.redhat_1.el8jws (unaffected)

Vendor states this is fixed in 0:1.3.6-1.redhat_1.el9jws (unaffected)

Vendor states this is fixed in 0:10.1.49-9.redhat_00007.1.el10jws (unaffected)

Vendor states this is fixed in 0:10.1.49-9.redhat_00007.1.el8jws (unaffected)

Vendor states this is fixed in 0:10.1.49-9.redhat_00007.1.el9jws (unaffected)

Vendor states this is fixed in 6.2.1 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://lists.apache.org/thread/292dlmx3fz1888v6v16221kpozq56gml