REDHAT-BUG-2457043: Medium severity Apache Tomcat vulnerability
CLIENTCERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116.
Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 11.0.21 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 10.1.54 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 9.0.117
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2457043?
The severity of REDHAT-BUG-2457043 is medium with a risk rating of 4.
How do I fix REDHAT-BUG-2457043?
To fix REDHAT-BUG-2457043, you should upgrade Apache Tomcat to a version that is not affected by this vulnerability.
Which versions of Apache Tomcat are affected by REDHAT-BUG-2457043?
REDHAT-BUG-2457043 affects Apache Tomcat versions from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, and from 9.0.92 through 9.0.116.
What is the main issue described in REDHAT-BUG-2457043?
The main issue in REDHAT-BUG-2457043 is that CLIENT_CERT authentication does not fail as expected when soft fail is disabled during FFM in Apache Tomcat.
When was REDHAT-BUG-2457043 published?
REDHAT-BUG-2457043 was published on April 9, 2026.