CVE-2026-86248
Apache Tomcat: CLIENT_CERT authentication does not fail when OCSP soft fail is disabled
Technology
Apache Tomcat
CVSS Score
9.8 / 10.0
Affected Versions
11.0.0-M14 to 11.0.25; 10.1.22 to 10.1.59; 9.0.92 to 9.0.121
Upstream Fix
11.0.26; 10.1.60; 9.0.122
Published
September 23, 2026
OSSeva Coverage
Fixed upstream
Description
The fix for CVE-2026-34500 was incomplete: CLIENT_CERT authentication could still soft-fail OCSP checks in some scenarios with the FFM-based OpenSSL implementation, even with soft fail disabled. Made public on 23 September 2026 and rated Moderate by the Tomcat security team. Fixed in 11.0.26, 10.1.60 and 9.0.122.
Is your Apache Tomcat deployment affected?
If you're running 11.0.0-M14 to 11.0.25; 10.1.22 to 10.1.59; 9.0.92 to 9.0.121, you need this patch. Book a discovery call to get covered.
Get a quote
Running Apache Tomcat 11.0.0-M14 to 11.0.25; 10.1.22 to 10.1.59; 9.0.92 to 9.0.121?
Send your work email and a senior engineer will tell you whether this CVE applies to your versions and who patches it. Reply within 1 business day.
Prefer to talk or read more first?