PT-2026-31714 · Apache+1 · Apache Tomcat+1

Haruki Oyama · Publicado 2026-04-02 · Atualizado 2026-05-22 · CVE-2026-34500

Positive Technologies (AI Summary) · Pt

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versões 11.0.0-M14 até 11.0.20, versões 10.1.22 até 10.1.53 e versões 9.0.92 até 9.0.116

Description A autenticação CLIENT CERT pode não falhar conforme o esperado em determinados cenários quando a falha suave está desabilitada e o FFM é usado.

Recommendations Atualize para a versão 11.0.21 Atualize para a versão 10.1.54 Atualize para a versão 9.0.117

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

BDU:2026-07146

BIT-TOMCAT-2026-34500

CVE-2026-34500

GHSA-24J9-X2WG-9QV6

MGASA-2026-0095

OESA-2026-1970

OPENSUSE-SU-2026:10547-1

OPENSUSE-SU-2026:10548-1

OPENSUSE-SU-2026:10549-1

OPENSUSE-SU-2026:20595-1

OPENSUSE-SU-2026:20611-1

OPENSUSE-SU-2026:20612-1

RHSA-2026:20405

SUSE-SU-2026:1558-1

SUSE-SU-2026:1572-1

SUSE-SU-2026:1603-1

SUSE-SU-2026:1604-1

Produtos afetados

Apache Tomcat

Red Os

Referências · 91

• https://github.com/apache/tomcat · Nota
• https://github.com/apache/tomcat/commit/c13e60e732ea6d07087293a41ad1866c20848271 · Nota
• https://github.com/apache/tomcat/commit/29b56a56ce9e7d044b6162a99af0f38529b3a208 · Nota
• https://github.com/apache/tomcat/commit/ff589ab26e8250a2ca4286d986305318c033ff9f · Nota
• https://advisories.mageia.org/MGASA-2026-0095.html · Nota de Segurança
• https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.117 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2026:1572-1 · Aviso do Fabricante
• https://access.redhat.com/security/cve/cve-2026-34500 · Nota
• https://openwall.com/lists/oss-security/2026/04/09/28 · Nota
• https://suse.com/support/update/announcement/2026/suse-su-20261558-1 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-34500 · Nota de Segurança
• https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.21 · Nota
• https://suse.com/security/cve/CVE-2026-25854 · Nota
• https://bugzilla.suse.com/1261855 · Nota
• https://openwall.com/lists/oss-security/2026/04/09/22 · Nota