CVE-2026-34500Disclosure(apache / tomcat)

LOWCVSS 6.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue.

apache CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-287

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

tomcat

Threat summary

4 mentions across 4 observed days
Momentum state: stable

What's happening

Technical details provided in 3 signals
Disclosure: 3 classified signals
General: 1 classified signal
Peaked 3d ago at 1 mentions (2026-04-09); latest day: 1
4 total mentions across 4 days

Affected systems

Vendors

apache

Products

tomcat

1 version affected across 1 product

Deep dive

Activity timeline4 mentions / 4d

Signal classification2 categories

Disclosure

375.0%

General

125.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-09	1	Disclosure1
2026-04-10	1	General1
2026-04-20	1	Disclosure1
2026-09-23	1	Disclosure1

Full discourse4 posts

iototsecnews@iototsecnews174d
Disclosure
Apache Tomcat の脆弱性 CVE-2026-29146／34486／34500 が FIX：EncryptInterceptor バイパスの可能性 https://iototsecnews.jp/2026/04/13/apache-tomcat-flaws-enable-encryptinterceptor-bypass/ これらの Apache Tomcat の脆弱性は、暗号化の仕組みや修正時の不備が主な原因となっています。 CVE-2026-29146 では、暗号化モードの特性により外部から通信内容を推測される状態にありました。これを直そうとした際のコードの不備が CVE-2026-34486 という新たな問題を生み、セキュリティ機能自体が回避される結果を招いています。また CVE-2026-34500 では、証明書の失効を確認する際の処理が設定通りに動かず、本来拒否すべきアクセスを許可してしまう不備が発生しました。ご利用のチームは、ご注意ください。 #Apache #CVE202629146 #CVE202634486 #CVE202634500 #Tomcat #Vulnerability
Post summary
The post announces three Apache Tomcat CVEs that enable EncryptedInterceptor bypass, detailing technical flaws but providing no PoC, exploit code, or evidence of active exploitation.
01000130
486 followersView on X
Kazuki Omo@omokazuki184d
General
SIOSセキュリティブログを更新しました。 Apache Tomcatの脆弱性(Important: CVE-2026-34486, Moderate: CVE-2026-34500, CVE-2026-32990, Low: CVE-2026-34487, CVE-2026-34483) #sios_tech #security #vulnerability #セキュリティ #脆弱性 #linux #tomcat #apache https://security.sios.jp/vulnerability/tomcat-security-vulnerability-20260410/
Post summary
The post announces several CVEs for Apache Tomcat with severity classification but lacks technical details, exploitation information, or patch notes.
00010165
361 followersView on X
SecAlerts@SecAlertsCo17d
Disclosure
🐱 Apache Tomcat CVE-2026-86248: fix for CVE-2026-34500 was incomplete. OCSP checks still soft-fail even when disabled, so CLIENT_CERT auth may not reject as expected. CVSS 9.8. Affects 11.0.0-M14–11.0.25. #cybersecurity #ciso #cto #vulnerabilities https://secalerts.co/vulnerability/CVE-2026-86248?utm_campaign=x https://t.co/PgLaKoZ8xN
Post summary
The tweet discloses CVE-2026-86248 in Apache Tomcat, noting that an earlier fix for CVE-2026-34500 was incomplete, leaving OCSP checks to soft-fail and potentially allowing CLIENT_CERT authentication to be bypassed. It provides a CVSS score of 9.8 and lists affected versions.
0000079
892 followersView on X
CVE@CVEnew184d
Disclosure
CVE-2026-34500 CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat. This issue affects Apache Tomcat… https://www.cve.org/CVERecord?id=CVE-2026-34500
Post summary
The text outlines a newly disclosed vulnerability in Apache Tomcat that causes client‑certificate authentication to fail under certain configurations, but offers no exploit, patch, or PoC details.
00000134
57.0K followersView on X

CPE platform detail14 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

14 of 14 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	apache	tomcat	-	-	-
App	apache	tomcat	11.0.0	-	-
App	apache	tomcat	11.0.0	-	-
App	apache	tomcat	11.0.0	-	-
App	apache	tomcat	11.0.0	-	-
App	apache	tomcat	11.0.0	-	-
App	apache	tomcat	11.0.0	-	-
App	apache	tomcat	11.0.0	-	-
App	apache	tomcat	11.0.0	-	-
App	apache	tomcat	11.0.0	-	-
App	apache	tomcat	11.0.0	-	-
App	apache	tomcat	11.0.0	-	-
App	apache	tomcat	11.0.0	-	-
App	apache	tomcat	11.0.0	-	-

Explore more

Back to dashboard apache CVEs tomcat vulnerabilities

What researchers are saying

CVE-2026-34500

iototsecnews@iototsecnewsDisclosure

The post announces three Apache Tomcat CVEs that enable EncryptedInterceptor bypass, detailing technical flaws but providing no PoC, exploit code, or evidence of active exploitation.

Kazuki Omo@omokazukiGeneral

The post announces several CVEs for Apache Tomcat with severity classification but lacks technical details, exploitation information, or patch notes.

SecAlerts@SecAlertsCoDisclosure

The tweet discloses CVE-2026-86248 in Apache Tomcat, noting that an earlier fix for CVE-2026-34500 was incomplete, leaving OCSP checks to soft-fail and potentially allowing CLIENT_CERT authentication to be bypassed. It provides a CVSS score of 9.8 and lists affected versions.

CVE@CVEnewDisclosure

The text outlines a newly disclosed vulnerability in Apache Tomcat that causes client‑certificate authentication to fail under certain configurations, but offers no exploit, patch, or PoC details.