REDHAT-BUG-2542847: Medium severity Apache Tomcat vulnerability
Published Sep 28, 2026
·Updated
CLIENTCERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from 10.1.22 through 10.1.59, from 9.0.92 through 9.0.121.
Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
Affected Software
1 affected component
Apache Tomcat>=11.0.0-M14<=11.0.25, >=10.1.22<=10.1.59, >=9.0.92<=9.0.121
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 11.0.26 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 10.1.60 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 9.0.122
Event History
Sep 28, 2026
Data Sourced
via Red Hat·10:46 PM
DescriptionSeverityAffected Software