---
id: "CVE-2026-74048"
kind: "vulnerability"
aliases: ["CVE-2026-74048"]
title: "Apache Tomcat: FIPS mode failure silently falls back to non-FIPS crypto"
severity: "low"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["java", "runtime", "self-hosted", "tomcat"]
not_affected_if: ["default-config", "no-fips-mode"]
published_at: "2026-10-20T14:17:00+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-25T05:04:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74048", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# Apache Tomcat: FIPS mode failure silently falls back to non-FIPS crypto

When Tomcat's OpenSSLLifecycleListener is set to FIPS mode and FIPS activation fails, Tomcat logs an error but keeps running with JSSE in non-FIPS mode. The server continues to serve TLS with cryptography that does not meet the FIPS requirement the operator configured.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Tomcat version with `catalina.sh version` and compare it to the affected ranges: 11.0.0-M14 to 11.0.26, 10.1.22 to 10.1.60, 9.0.92 to 9.0.122.
- Look for `OpenSSLLifecycleListener` with FIPS mode enabled in `conf/server.xml`.

## Fix

- Upgrade Apache Tomcat to `11.0.27`, `10.1.61` or `9.0.123` depending on the major line.

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-74048

## From the sources

Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration.



This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.26, from 10.1.22 through 10.1.60, from 9.0.92 through 9.0.122.



Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_