CVE-2026-86248: Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled
Apache Tomcat CVE-2026-86248 can soft-fail some OCSP checks during client-certificate authentication.
Apache disclosed CVE-2026-86248, a moderate Tomcat flaw in which the fix for CVE-2026-34500 was incomplete. With the foreign-function memory path, some OCSP checks can soft-fail even when soft-fail is disabled, so CLIENT_CERT authentication does not fail as expected. Affected ranges are Tomcat 11.0.0-M14 through 11.0.25, 10.1.22 through 10.1.59, and 9.0.92 through 9.0.121. The advisory does not report active exploitation.
- CVE-2026-86248 is an incomplete fix for CVE-2026-34500.
- OCSP checks can soft-fail with FFM even when soft-fail is disabled.
- CLIENT_CERT authentication may not fail in some expected scenarios.
- Apache rates the issue moderate; no exploitation is reported.
- Vendors
- Apache Software Foundation
- Products
- Apache Tomcat
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-34500 | CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat | 6.5 | <1% | ||
| CVE-2026-86248 | Client-Certificate Authentication Bypass via OCSP Soft-Fail in Apache Tomcat | 9.8 | — |
From the original article
Posted by Mark Thomas on Sep 23 Severity: moderate Affected versions: - Apache Tomcat 11. 0. 0-M14 through 11.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.