{"id":"CVE-2026-74048","kind":"vulnerability","aliases":["CVE-2026-74048"],"related":[],"title":"Apache Tomcat: FIPS mode failure silently falls back to non-FIPS crypto","description":"Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.26, from 10.1.22 through 10.1.60, from 9.0.92 through 9.0.122.\n\n\n\nUsers are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.","summary":"When Tomcat's OpenSSLLifecycleListener is set to FIPS mode and FIPS activation fails, Tomcat logs an error but keeps running with JSSE in non-FIPS mode. The server continues to serve TLS with cryptography that does not meet the FIPS requirement the operator configured.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","runtime","self-hosted","tomcat"],"not_affected_if":["default-config","no-fips-mode"],"how_to_check":"- Check the Tomcat version with `catalina.sh version` and compare it to the affected ranges: 11.0.0-M14 to 11.0.26, 10.1.22 to 10.1.60, 9.0.92 to 9.0.122.\n- Look for `OpenSSLLifecycleListener` with FIPS mode enabled in `conf/server.xml`.","fix":"- Upgrade Apache Tomcat to `11.0.27`, `10.1.61` or `9.0.123` depending on the major line.","status":"open","published_at":"2026-10-20T14:17:00+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T05:04:49+00:00","updated_at":"2026-10-25T05:04:49+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-25T05:04:49Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache Tomcat to `11.0.27`, `10.1.61` or `9.0.123` depending on the major line.","reach":"network","title":"Apache Tomcat: FIPS mode failure silently falls back to non-FIPS crypto","impact":"low","summary":"When Tomcat's OpenSSLLifecycleListener is set to FIPS mode and FIPS activation fails, Tomcat logs an error but keeps running with JSSE in non-FIPS mode. The server continues to serve TLS with cryptography that does not meet the FIPS requirement the operator configured.","category":"runtime","nicknames":[],"who_cares":["tomcat","java","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"TLS silently runs without the required FIPS cryptography, weakening compliance","analyst_note":"","how_to_check":"- Check the Tomcat version with `catalina.sh version` and compare it to the affected ranges: 11.0.0-M14 to 11.0.26, 10.1.22 to 10.1.60, 9.0.92 to 9.0.122.\n- Look for `OpenSSLLifecycleListener` with FIPS mode enabled in `conf/server.xml`.","needs_analyst":false,"not_affected_if":["default-config","no-fips-mode"],"who_is_affected":"Only deployments that configure Tomcat's OpenSSLLifecycleListener for FIPS mode are exposed, because the flaw is the silent fallback when FIPS activation fails. Servers without FIPS configured, and teams that do not need FIPS compliance, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000641,"input_tokens":3413,"output_tokens":599,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-74048':16A,19A '10.1.22':122C '10.1.60':124C '10.1.61':137C '11.0.0':117C '11.0.26':120C '11.0.27':136C '9.0.122':128C '9.0.123':139C '9.0.92':126C 'activ':37B,91C 'affect':113C 'apach':1A,78C,114C 'back':8A 'configur':70B,84C,110C 'continu':55B,98C 'crypto':13A 'cryptographi':60B 'cve':14A,17A 'error':42B,96C 'fail':38B,72C,74C,92C 'failur':5A 'fall':7A 'fip':3A,12A,33B,36B,51B,66B,87C,90C,105C 'fix':141C 'host':24B 'issu':112C,143C 'java':20B 'jsse':47B,101C 'keep':44B 'log':40B,94C 'm14':118C 'meet':64B 'mode':4A,34B,52B,88C,106C 'non':11A,50B,104C 'non-fip':10A,49B,103C 'open':75C 'openssllifecyclelisten':29B,82C 'oper':69B 'provid':109C 'recommend':131C 'requir':67B 'run':45B 'runtim':21B 'secur':73C 'self':23B 'self-host':22B 'serv':57B 'server':54B 'set':31B 'silent':6A 'tls':58B 'tomcat':2A,25B,27B,39B,79C,93C,115C 'upgrad':133C 'use':86C,100C 'user':129C 'version':135C 'vulner':76C","nicknames":[],"mitigations":[],"who_affected":"Only deployments that configure Tomcat's OpenSSLLifecycleListener for FIPS mode are exposed, because the flaw is the silent fallback when FIPS activation fails. Servers without FIPS configured, and teams that do not need FIPS compliance, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T14:17:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-74048","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74048","severity":null,"published_at":"2026-10-20T14:17:00+00:00","modified_at":"2026-10-20T19:35:38+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}