Live › vulnerability › CVE-2026-74048
Go to dashboardWhen Tomcat's OpenSSLLifecycleListener is set to FIPS mode and FIPS activation fails, Tomcat logs an error but keeps running with JSSE in non-FIPS mode. The server continues to serve TLS with cryptography that does not meet the FIPS requirement the operator configured.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only deployments that configure Tomcat's OpenSSLLifecycleListener for FIPS mode are exposed, because the flaw is the silent fallback when FIPS activation fails. Servers without FIPS configured, and teams that do not need FIPS compliance, can skip it.
No product ranges from the sources yet.
catalina.sh version and compare it to the affected ranges: 11.0.0-M14 to 11.0.26, 10.1.22 to 10.1.60, 9.0.92 to 9.0.122.OpenSSLLifecycleListener with FIPS mode enabled in conf/server.xml.11.0.27, 10.1.61 or 9.0.123 depending on the major line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration.
This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.26, from 10.1.22 through 10.1.60, from 9.0.92 through 9.0.122.
Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-74048")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.