Race Condition in Apache Tomcat Native Weakens TLS Client Certificate Verification
AI analysis
Apache Tomcat Native (tc-native), the optional JNI library that lets Tomcat's APR/native connector use OpenSSL, contains a thread-level race condition (CWE-366) that can cause client certificate verification requirements to be downgraded for some configurations. If the race is won during TLS handshake processing, a server configured to require a valid client certificate (mutual TLS) may accept a connection without proper certificate verification, allowing an unauthenticated remote attacker to reach or impersonate clients on an endpoint that should have been protected. The flaw affects Tomcat Native 1.3.0 through 1.3.8 and 2.0.0 through 2.0.15, and unsupported older versions may also be affected; exploitation requires a vulnerable connector configuration plus favorable timing (reflected in the high attack-complexity CVSS score of 7.4). The impact is on confidentiality and integrity of mutually authenticated services, not availability. No public proof of concept is known, the issue is not on CISA's KEV list, and there are no reports of exploitation in the wild.
What to do: Upgrade Tomcat Native to 2.0.16 (2.0.x branch) or 1.3.9 (1.3.x branch) as soon as releases are available for your platform. Audit Tomcat servers for the APR/native connector combined with client certificate verification (e.g., clientAuth/SSLVerifyClient settings) — these are the configurations at risk, especially internet-facing or cross-trust-boundary mTLS endpoints. If patching must be delayed, consider switching affected connectors to the standard Java NIO/NIO2 connector with JSSE, which does not depend on the vulnerable library, and review access logs for unexpected handshakes from clients without valid certificates.
Affected
| Apache Software Foundation Apache Tomcat Native | 2.0.0 through 2.0.15 |
| Apache Software Foundation Apache Tomcat Native | 1.3.0 through 1.3.8 |
| Apache Software Foundation Apache Tomcat Native | Unsupported/older versions (may also be affected) |
Description
Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be affected. Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fixes the issue.