PT-2026-31699 · Apache+2 · Apache Tomcat Native+3
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Apache Tomcat versions 9.0.83 through 9.0.115
Apache Tomcat versions 10.1.0-M7 through 10.1.52
Apache Tomcat versions 11.0.0-M1 through 11.0.18
Apache Tomcat Native versions 1.1.23 through 1.1.34
Apache Tomcat Native versions 1.2.0 through 1.2.39
Apache Tomcat Native versions 1.3.0 through 1.3.6
Apache Tomcat Native versions 2.0.0 through 2.0.13
Description
An issue exists in Apache Tomcat and Apache Tomcat Native where CLIENT CERT authentication does not fail as expected in certain scenarios when soft fail is disabled.
Recommendations
Upgrade Apache Tomcat to version 11.0.20, 10.1.53, or 9.0.116.
Upgrade Apache Tomcat Native to version 1.3.7 or 2.0.14.
Exploit
Fix
Improper Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Apache Tomcat
Apache Tomcat Native
Confluence
Red Os