Live › vulnerability › CVE-2026-24734
Tomcat Native and Tomcat's FFM port did not fully verify or check the freshness of OCSP responses when an OCSP responder is used. An attacker may be able to get a revoked certificate accepted, bypassing revocation.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 03:16 UTC, 1h before NVD. All times on this page are UTC.
Only deployments that use OCSP revocation checking with Tomcat or Tomcat Native (including the FFM port) are exposed; the advisory lists affected Tomcat 9.0.83 through 9.0.114, 10.1.0-M7 through 10.1.51, and 11.0.0-M1 through 11.0.17, and Tomcat Native 1.3.0 through 1.3.4 and 2.0.0 through 2.0.11. Teams that do not use OCSP for client or server certificate checks can skip it, though the affected versions should still be upgraded.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| org.apache.tomcat:tomcat-coyote | maven | >= 11.0.0-M1, < 11.0.18 | 11.0.18 |
| org.apache.tomcat:tomcat-coyote | maven | >= 10.1.0-M7, < 10.1.52 | 10.1.52 |
| org.apache.tomcat:tomcat-coyote | maven | >= 9.0.83, < 9.0.115 | 9.0.115 |
| org.apache.tomcat.embed:tomcat-embed-core | maven | >= 11.0.0-M1, < 11.0.18 | 11.0.18 |
| org.apache.tomcat.embed:tomcat-embed-core | maven | >= 10.1.0-M7, < 10.1.52 | 10.1.52 |
| org.apache.tomcat.embed:tomcat-embed-core | maven | >= 9.0.83, < 9.0.115 | 9.0.115 |
| org.apache.tomcat:tomcat-coyote-ffm |
| maven |
| >= 11.0.0-M1, < 11.0.18 |
| 11.0.18 |
| org.apache.tomcat:tomcat-coyote-ffm | maven | >= 10.1.0-M7, < 10.1.52 | 10.1.52 |
| org.apache.tomcat:tomcat-coyote-ffm | maven | >= 9.0.83, < 9.0.115 | 9.0.115 |
| apache tomcat | vendor | >= 9.0.83, < 9.0.115 | 9.0.115 |
| apache tomcat | vendor | >= 10.1.1, < 10.1.52 | 10.1.52 |
| apache tomcat | vendor | >= 11.0.1, < 11.0.18 | 11.0.18 |
| apache tomcat | vendor | = 10.1.0 | – |
| apache tomcat | vendor | = 11.0.0 | – |
| apache tomcat native | vendor | >= 1.3.0, < 1.3.5 | 1.3.5 |
| apache tomcat native | vendor | >= 2.0.0, < 2.0.12 | 2.0.12 |
catalina.sh version or the tomcat-coyote / tomcat-embed-core version in your Maven or Gradle dependency tree.11.0.18 or later10.1.52 or later9.0.115 or later1.3.5 or later, or 2.0.12 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat.
When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification or freshness checks on the OCSP response which could allow certificate revocation to be bypassed.
This issue affects Apache Tomcat Native: from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11; Apache Tomcat: from 11.0.0-M1 through 11.0.17, from 10.1.0-M7 through 10.1.51, from 9.0.83 through 9.0.114.
The following versions were EOL at the time the CVE was created but are known to be affected: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39. Older EOL versions are not affected.
Apache Tomcat Native users are recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which fix the issue.
Apache Tomcat users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115 or later which fix the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-24734")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.