PT-2026-31714

CVE-2026-34500

·

Published

2026-04-02

·

Updated

2026-10-30

Description by

CVSS 3.1
9.1
Critical
MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M14 through 11.0.20, versions 10.1.22 through 10.1.53, and versions 9.0.92 through 9.0.116
Description CLIENT CERT authentication may not fail as expected in certain scenarios when soft fail is disabled and FFM is used.
Recommendations Upgrade to version 11.0.21 Upgrade to version 10.1.54 Upgrade to version 9.0.117
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-287: Improper Authentication
Related identifiers
CVE-2026-34500
BDU:2026-07146
GHSA-24J9-X2WG-9QV6
ALSA-2026:25341
ALSA-2026:26323
ALSA-2026:36790
BIT-TOMCAT-2026-34500
CLEANSTART-2026-LN56508
CLEANSTART-2026-SZ16719
MGASA-2026-0095
OESA-2026-1970
OPENSUSE-SU-2026:10547-1
OPENSUSE-SU-2026:10548-1
OPENSUSE-SU-2026:10549-1
OPENSUSE-SU-2026:20595-1
OPENSUSE-SU-2026:20611-1
OPENSUSE-SU-2026:20612-1
RHSA-2026:20405
SUSE-SU-2026:1558-1
SUSE-SU-2026:1572-1
SUSE-SU-2026:1603-1
SUSE-SU-2026:1604-1
SUSE-SU-2026:21366-1
SUSE-SU-2026:21378-1
SUSE-SU-2026:21379-1
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com