Kurz gesagt
- CVE-2026-34500 ist eine Schwachstelle (MITTEL (CVSS 6.5)) in org.apache.tomcat:tomcat-coyote-ffm, tomcat (apache).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.45%, höher als bei 39.2% aller Schwachstellen.
- Abhilfe: auf 10.1.54, 11.0.21, 9.0.117 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| org.apache.tomcat:tomcat-coyote-ffm Maven | ≥ 10.1.22, < 10.1.54≥ 11.0.0-M14, < 11.0.21≥ 9.0.92, < 9.0.117
| 10.1.5411.0.219.0.117
|
| tomcat | = 11.0.0≥ 10.1.22, < 10.1.54≥ 11.0.1, < 11.0.21≥ 9.0.92, < 9.0.117
| 10.1.5411.0.219.0.117
|
Description
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116.
Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue.
NVD description
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116.
Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue.
Weitere Schwachstellen in org.apache.tomcat:tomcat-coyote-ffm
Alle anzeigen →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free