PT-2026-31699 · Apache+2 · Apache Tomcat Native+3

Gregk4Sec · Publicado 2026-03-23 · Atualizado 2026-06-02 · CVE-2026-29145

Positive Technologies (AI Summary) · Pt

CVSS v2.0

9.4

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versões 9.0.83 através de 9.0.115 Apache Tomcat versões 10.1.0-M7 através de 10.1.52 Apache Tomcat versões 11.0.0-M1 através de 11.0.18 Apache Tomcat Native versões 1.1.23 através de 1.1.34 Apache Tomcat Native versões 1.2.0 através de 1.2.39 Apache Tomcat Native versões 1.3.0 através de 1.3.6 Apache Tomcat Native versões 2.0.0 através de 2.0.13

Description Existe uma falha no Apache Tomcat e no Apache Tomcat Native onde a autenticação CLIENT CERT não falha conforme o esperado em certos cenários quando o soft fail está desabilitado.

Recommendations Atualize o Apache Tomcat para a versão 11.0.20, 10.1.53 ou 9.0.116. Atualize o Apache Tomcat Native para a versão 1.3.7 ou 2.0.14.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

BDU:2026-06931

BIT-TOMCAT-2026-29145

CLEANSTART-2026-IS05941

CVE-2026-29145

GHSA-95JQ-RWVF-VJX4

MGASA-2026-0095

OESA-2026-1970

OPENSUSE-SU-2026:10547-1

OPENSUSE-SU-2026:10548-1

OPENSUSE-SU-2026:10549-1

OPENSUSE-SU-2026:20595-1

OPENSUSE-SU-2026:20611-1

OPENSUSE-SU-2026:20612-1

RHSA-2026:20405

SUSE-SU-2026:1558-1

SUSE-SU-2026:1572-1

SUSE-SU-2026:1603-1

SUSE-SU-2026:1604-1

Produtos afetados

Apache Tomcat

Apache Tomcat Native

Confluence

Red Os

Referências · 136

• https://github.com/apache/tomcat · Nota
• https://github.com/apache/tomcat/commit/d1406df5ae0326f39f54c3f64ac30d8fca55cd5b · Nota
• https://github.com/apache/tomcat/commit/fe26667cd2385045ac73f4dea086cc9971209b90 · Nota
• https://github.com/apache/tomcat/commit/721591f7bff424c693f26adc18ae9b9abac3655b · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-IS05941.json · Nota
• https://osv.dev/vulnerability/CVE-2026-22737 · Nota
• https://bugzilla.suse.com/1261853 · Nota
• https://suse.com/support/update/announcement/2026/suse-su-20261604-1 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-34500 · Nota de Segurança
• https://twitter.com/pulsepatchio/status/2042797025725477353 · Publicação no Twitter
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-29145 · Nota
• https://bugzilla.suse.com/1261850 · Nota
• https://osv.dev/vulnerability/CVE-2026-22735 · Nota
• https://osv.dev/vulnerability/CLEANSTART-2026-IS05941 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2026-29145 · Nota