BIT-tomcat-2026-74048: Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up

Q: Which deployments are exposed to this issue?

Deployments are affected when Apache Tomcat uses the OpenSSLLifecycleListener configured for FIPS mode and FIPS activation fails. The affected version ranges are 11.0.0 through 11.0.26, 10.1.22 through 10.1.60, and 9.0.92 through 9.0.122.

Q: What happens when exploitation conditions occur?

No attacker action is described. If FIPS activation fails, Tomcat logs an error but continues to start using JSSE in non-FIPS mode with the supplied configuration, rather than preventing startup.

Q: How can I tell whether an instance may be operating outside FIPS mode?

Review whether OpenSSLLifecycleListener is configured for FIPS mode and inspect Tomcat logs for an error indicating FIPS activation failed. An affected instance may still be running because Tomcat continues startup after that failure.

Q: What is the recommended remediation?

Upgrade to Apache Tomcat 11.0.27, 10.1.61, or 9.0.123, as appropriate for the deployed release line.

Published Oct 29, 2026

Updated

Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration.

This issue affects Apache Tomcat: from 11.0.0 through 11.0.26, from 10.1.22 through 10.1.60, from 9.0.92 through 9.0.122.

Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.

Affected Software

3 affected componentsFixes available

bitnami/tomcat>=9.0.92<9.0.123

9.0.123

bitnami/tomcat>=10.1.22<10.1.61

10.1.61

bitnami/tomcat>=11.0.0<11.0.27

11.0.27

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade bitnami/tomcat to a version that resolves this vulnerability.
Fixed in 9.0.123
Upgrade
Upgrade bitnami/tomcat to a version that resolves this vulnerability.
Fixed in 10.1.61
Upgrade
Upgrade bitnami/tomcat to a version that resolves this vulnerability.
Fixed in 11.0.27
Upgrade
Upgrade Apache Tomcat to a version that resolves this vulnerability.
Fixed in 11.0.27
Upgrade
Upgrade Apache Tomcat to a version that resolves this vulnerability.
Fixed in 10.1.61
Upgrade
Upgrade Apache Tomcat to a version that resolves this vulnerability.
Fixed in 9.0.123

Event History

Oct 29, 2026

Advisory Published

via OSV·09:02 AM

Data Sourced

via OSV·09:02 AM

DescriptionAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments are affected when Apache Tomcat uses the OpenSSLLifecycleListener configured for FIPS mode and FIPS activation fails. The affected version ranges are 11.0.0 through 11.0.26, 10.1.22 through 10.1.60, and 9.0.92 through 9.0.122.

What happens when exploitation conditions occur?