Apache Tomcat: CLIENT_CERT authentication does not fail as expected

中 6.5CVE-2026-34500 · BIT-tomcat-2026-34500 · GHSA-24j9-x2wg-9qv6 · 09/04/2026 公開 · 26/10/2026 更新

要点

CVE-2026-34500 は org.apache.tomcat:tomcat-coyote-ffm, tomcat (apache) に影響する深刻度「中」 (CVSS 6.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.45%（全脆弱性の 39.1% より高い）。
対処：10.1.54, 11.0.21, 9.0.117 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.apache.tomcat:tomcat-coyote-ffm Maven	`≥ 10.1.22, < 10.1.54≥ 11.0.0-M14, < 11.0.21≥ 9.0.92, < 9.0.117`	`10.1.5411.0.219.0.117`
tomcat apache	`= 11.0.0≥ 10.1.22, < 10.1.54≥ 11.0.1, < 11.0.21≥ 9.0.92, < 9.0.117`	`10.1.5411.0.219.0.117`

概要

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue.

NVD の説明

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue.