PT-2026-31714 · Apache+1 · Apache Tomcat+1

Haruki Oyama · Published 2026-04-02 · Updated 2026-05-06 · CVE-2026-34500

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M14 through 11.0.20, versions 10.1.22 through 10.1.53, and versions 9.0.92 through 9.0.116

Description CLIENT CERT authentication may not fail as expected in certain scenarios when soft fail is disabled and FFM is used.

Recommendations Upgrade to version 11.0.21 Upgrade to version 10.1.54 Upgrade to version 9.0.117

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2026-07146

BIT-TOMCAT-2026-34500

CVE-2026-34500

GHSA-24J9-X2WG-9QV6

MGASA-2026-0095

OESA-2026-1970

OPENSUSE-SU-2026:10547-1

OPENSUSE-SU-2026:10548-1

OPENSUSE-SU-2026:10549-1

OPENSUSE-SU-2026:20595-1

OPENSUSE-SU-2026:20611-1

OPENSUSE-SU-2026:20612-1

SUSE-SU-2026:1558-1

SUSE-SU-2026:1572-1

SUSE-SU-2026:1603-1

SUSE-SU-2026:1604-1

Affected Products

Apache Tomcat

Red Os

References · 91

• https://nvd.nist.gov/vuln/detail/CVE-2026-29146 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10549-1 · Vendor Advisory
• https://lists.apache.org/thread/7rcl4zdxryc8hy3htyfyxkbqpxjtfdl2 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1970 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20612-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2026-0095 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34483 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:20611-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-29129 · Security Note
• https://osv.dev/vulnerability/BIT-tomcat-2026-34500 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20595-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10547-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32990 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:1604-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1603-1 · Vendor Advisory