En bref
- CVE-2026-34500 est une vulnérabilité MOYENNE (CVSS 6.5) touchant org.apache.tomcat:tomcat-coyote-ffm, tomcat (apache).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.45%, plus élevée que 39.1% des vulnérabilités.
- Correctif : mettre à jour vers 10.1.54, 11.0.21, 9.0.117 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| org.apache.tomcat:tomcat-coyote-ffm Maven | ≥ 10.1.22, < 10.1.54≥ 11.0.0-M14, < 11.0.21≥ 9.0.92, < 9.0.117
| 10.1.5411.0.219.0.117
|
| tomcat | = 11.0.0≥ 10.1.22, < 10.1.54≥ 11.0.1, < 11.0.21≥ 9.0.92, < 9.0.117
| 10.1.5411.0.219.0.117
|
Description
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116.
Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue.
NVD description
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116.
Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue.
Autres vulnérabilités de org.apache.tomcat:tomcat-coyote-ffm
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free