CVE-2026-86248: Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue.

Apache Tomcat's CLIENT_CERT (mutual TLS) authentication can fail open during certificate revocation checking: in some scenarios, OCSP checks performed via the FFM (Foreign Function & Memory) API soft-fail — treating an unverifiable or failed revocation check as passing — even when the administrator has explicitly disabled soft-fail. This is an incomplete fix for CVE-2026-34500. An attacker holding a revoked client certificate could present it to a protected application and still be authenticated, defeating the intended hard-fail policy and gaining whatever access that certificate's identity is authorized for. Only deployments using client-certificate authentication with OCSP revocation checking and soft-fail disabled are affected; standard deployments without mTLS or without revocation checks are not. No CVSS score has been assigned, no public proof of concept exists, and the issue is not in the CISA KEV catalog, so exploitation is not known to be occurring.

Do: Upgrade to Apache Tomcat 11.0.26, 10.1.60, or 9.0.122 depending on your branch. If immediate patching is not possible, audit connectors using client-certificate authentication: verify whether OCSP soft-fail is disabled and whether the FFM-based OCSP path is in use, and consider adding CRL-based revocation checking as a compensating control. Review authentication logs for successful client-cert logins during OCSP responder outages or errors, since those are the sessions most likely to have bypassed the intended policy.