---
id: "CVE-2026-24734"
kind: "vulnerability"
aliases: ["CVE-2026-24734", "GHSA-mgp5-rv84-w37q"]
title: "Apache Tomcat has an Improper Input Validation vulnerability"
severity: "high"
cvss: 7.5
epss: 0.00575
exploited: false
status: "open"
category: "package"
products: [{"name": "org.apache.tomcat:tomcat-coyote", "fixed": ["11.0.18"], "affected": ">= 11.0.0-M1, < 11.0.18", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat-coyote", "fixed": ["10.1.52"], "affected": ">= 10.1.0-M7, < 10.1.52", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat-coyote", "fixed": ["9.0.115"], "affected": ">= 9.0.83, < 9.0.115", "ecosystem": "maven"}, {"name": "org.apache.tomcat.embed:tomcat-embed-core", "fixed": ["11.0.18"], "affected": ">= 11.0.0-M1, < 11.0.18", "ecosystem": "maven"}, {"name": "org.apache.tomcat.embed:tomcat-embed-core", "fixed": ["10.1.52"], "affected": ">= 10.1.0-M7, < 10.1.52", "ecosystem": "maven"}, {"name": "org.apache.tomcat.embed:tomcat-embed-core", "fixed": ["9.0.115"], "affected": ">= 9.0.83, < 9.0.115", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat-coyote-ffm", "fixed": ["11.0.18"], "affected": ">= 11.0.0-M1, < 11.0.18", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat-coyote-ffm", "fixed": ["10.1.52"], "affected": ">= 10.1.0-M7, < 10.1.52", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat-coyote-ffm", "fixed": ["9.0.115"], "affected": ">= 9.0.83, < 9.0.115", "ecosystem": "maven"}, {"name": "apache tomcat", "fixed": ["9.0.115"], "affected": ">= 9.0.83, < 9.0.115", "ecosystem": "vendor"}, {"name": "apache tomcat", "fixed": ["10.1.52"], "affected": ">= 10.1.1, < 10.1.52", "ecosystem": "vendor"}, {"name": "apache tomcat", "fixed": ["11.0.18"], "affected": ">= 11.0.1, < 11.0.18", "ecosystem": "vendor"}, {"name": "apache tomcat", "fixed": [], "affected": "= 10.1.0", "ecosystem": "vendor"}, {"name": "apache tomcat", "fixed": [], "affected": "= 11.0.0", "ecosystem": "vendor"}, {"name": "apache tomcat native", "fixed": ["1.3.5"], "affected": ">= 1.3.0, < 1.3.5", "ecosystem": "vendor"}, {"name": "apache tomcat native", "fixed": ["2.0.12"], "affected": ">= 2.0.0, < 2.0.12", "ecosystem": "vendor"}]
ecosystems: ["maven", "vendor"]
tags: ["apache-tomcat", "cwe-20", "cwe-295", "java", "ocsp", "package", "tls"]
not_affected_if: ["default-config", "no-ocsp-checking"]
published_at: "2026-02-17T19:21:56+00:00"
first_seen_at: "2026-11-04T03:16:03+00:00"
updated_at: "2026-11-04T03:46:40+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-mgp5-rv84-w37q", "first_seen_at": "2026-11-04T03:16:03+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24734", "first_seen_at": "2026-11-04T03:46:40+00:00"}]
---

# Apache Tomcat has an Improper Input Validation vulnerability

Tomcat Native and Tomcat's FFM port did not fully verify or check the freshness of OCSP responses when an OCSP responder is used. An attacker may be able to get a revoked certificate accepted, bypassing revocation.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:org.apache.tomcat:tomcat-coyote affected >= 11.0.0-M1, < 11.0.18 fixed 11.0.18
- maven:org.apache.tomcat:tomcat-coyote affected >= 10.1.0-M7, < 10.1.52 fixed 10.1.52
- maven:org.apache.tomcat:tomcat-coyote affected >= 9.0.83, < 9.0.115 fixed 9.0.115
- maven:org.apache.tomcat.embed:tomcat-embed-core affected >= 11.0.0-M1, < 11.0.18 fixed 11.0.18
- maven:org.apache.tomcat.embed:tomcat-embed-core affected >= 10.1.0-M7, < 10.1.52 fixed 10.1.52
- maven:org.apache.tomcat.embed:tomcat-embed-core affected >= 9.0.83, < 9.0.115 fixed 9.0.115
- maven:org.apache.tomcat:tomcat-coyote-ffm affected >= 11.0.0-M1, < 11.0.18 fixed 11.0.18
- maven:org.apache.tomcat:tomcat-coyote-ffm affected >= 10.1.0-M7, < 10.1.52 fixed 10.1.52
- maven:org.apache.tomcat:tomcat-coyote-ffm affected >= 9.0.83, < 9.0.115 fixed 9.0.115
- vendor:apache tomcat affected >= 9.0.83, < 9.0.115 fixed 9.0.115
- vendor:apache tomcat affected >= 10.1.1, < 10.1.52 fixed 10.1.52
- vendor:apache tomcat affected >= 11.0.1, < 11.0.18 fixed 11.0.18
- vendor:apache tomcat affected = 10.1.0 fixed ?
- vendor:apache tomcat affected = 11.0.0 fixed ?
- vendor:apache tomcat native affected >= 1.3.0, < 1.3.5 fixed 1.3.5
- vendor:apache tomcat native affected >= 2.0.0, < 2.0.12 fixed 2.0.12

## How to check

- Check the Tomcat version in use, for example with `catalina.sh version` or the `tomcat-coyote` / `tomcat-embed-core` version in your Maven or Gradle dependency tree.
- Check whether Tomcat Native is installed and which version, and whether OCSP checking is enabled in your TLS connector settings.

## Fix

- Apache Tomcat 11.x: `11.0.18` or later
- Apache Tomcat 10.1.x: `10.1.52` or later
- Apache Tomcat 9.0.x: `9.0.115` or later
- Apache Tomcat Native: `1.3.5` or later, or `2.0.12` or later

## Timeline

- 2026-11-04T03:16:03+00:00 ghsa https://github.com/advisories/GHSA-mgp5-rv84-w37q
- 2026-11-04T03:46:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-24734

## Documents

- [advisory] Vendor advisory: lists.apache.org https://lists.apache.org/thread/292dlmx3fz1888v6v16221kpozq56gml
- [fix] Patch: github.com https://github.com/apache/tomcat/commit/e76e9eaa246f30debd603726d9147a8a8cb5171c

## From the sources

Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat.

When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification or freshness checks on the OCSP response which could allow certificate revocation to be bypassed.

This issue affects Apache Tomcat Native:  from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11; Apache Tomcat: from 11.0.0-M1 through 11.0.17, from 10.1.0-M7 through 10.1.51, from 9.0.83 through 9.0.114.


The following versions were EOL at the time the CVE was created but are 
known to be affected: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39. Older EOL versions are not affected.

Apache Tomcat Native users are recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which fix the issue.

Apache Tomcat users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115 or later which fix the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_