Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2026-34500

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue.

VectorNETWORK

PublishedApr 09, 2026, 20:16

Published Bysecurity@apache.org

Base Score

Score6.5

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

org.apache.tomcat:tomcat-coyote-ffm(Maven)9.0.929.0.117N/A

org.apache.tomcat:tomcat-coyote-ffm(Maven)10.1.2210.1.54N/A

org.apache.tomcat:tomcat-coyote-ffm(Maven)11.0.0-M1411.0.21N/A

References

https://lists.apache.org/thread/7rcl4zdxryc8hy3htyfyxkbqpxjtfdl2
http://www.openwall.com/lists/oss-security/2026/04/09/29

Weakness Type

CWE-287

CVSS Metrics

Base Score

6.5

Vector String

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Base SeverityMedium

Version

3.1

Attack Vector (AV)

NETWORK