Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
Apache Tomcat and Apache Tomcat Native: Certificate Revocation Bypass Possible
CVE-2026-24734
Summary
Apache Tomcat and Apache Tomcat Native have a flaw that could allow a malicious certificate to be used even if it's been revoked. This means a hacker could potentially use a fake certificate to pose as a trusted site or service. To fix this, update to the latest version of either software, at least version 1.3.5 or 2.0.12 for Tomcat Native, or version 11.0.18, 10.1.52, or 9.0.115 for Tomcat.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions | Fix available |
|---|---|---|---|
| apache | tomcat | > 9.0.83 , <= 9.0.115 | – |
| apache | tomcat | > 10.1.1 , <= 10.1.52 | – |
| apache | tomcat | > 11.0.1 , <= 11.0.18 | – |
| apache | tomcat | 10.1.0 | – |
| apache | tomcat | 10.1.0 | – |
| apache | tomcat | 10.1.0 | – |
| apache | tomcat | 10.1.0 | – |
| apache | tomcat | 10.1.0 | – |
| apache | tomcat | 10.1.0 | – |
| apache | tomcat | 10.1.0 | – |
| apache | tomcat | 10.1.0 | – |
| apache | tomcat | 10.1.0 | – |
| apache | tomcat | 10.1.0 | – |
| apache | tomcat | 10.1.0 | – |
| apache | tomcat | 10.1.0 | – |
| apache | tomcat | 10.1.0 | – |
| apache | tomcat | 10.1.0 | – |
| apache | tomcat | 10.1.0 | – |
| apache | tomcat | 10.1.0 | – |
| apache | tomcat | 10.1.0 | – |
| apache | tomcat | 10.1.0 | – |
| apache | tomcat | 10.1.0 | – |
| apache | tomcat | 10.1.0 | – |
| apache | tomcat | 11.0.0 | – |
| apache | tomcat | 11.0.0 | – |
| apache | tomcat | 11.0.0 | – |
| apache | tomcat | 11.0.0 | – |
| apache | tomcat | 11.0.0 | – |
| apache | tomcat | 11.0.0 | – |
| apache | tomcat | 11.0.0 | – |
| apache | tomcat | 11.0.0 | – |
| apache | tomcat | 11.0.0 | – |
| apache | tomcat | 11.0.0 | – |
| apache | tomcat | 11.0.0 | – |
| apache | tomcat | 11.0.0 | – |
| apache | tomcat | 11.0.0 | – |
| apache | tomcat | 11.0.0 | – |
| apache | tomcat | 11.0.0 | – |
| apache | tomcat | 11.0.0 | – |
| apache | tomcat | 11.0.0 | – |
| apache | tomcat | 11.0.0 | – |
| apache | tomcat | 11.0.0 | – |
| apache | tomcat | 11.0.0 | – |
| apache | tomcat | 11.0.0 | – |
| apache | tomcat | 11.0.0 | – |
| apache | tomcat | 11.0.0 | – |
| apache | tomcat | 11.0.0 | – |
| apache | tomcat | 11.0.0 | – |
| apache | tomcat | 11.0.0 | – |
| apache | tomcat_native | > 1.3.0 , <= 1.3.5 | – |
| apache | tomcat_native | > 2.0.0 , <= 2.0.12 | – |
Original title
Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat.
When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verif...
Original description
Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat.
When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification or freshness checks on the OCSP response which could allow certificate revocation to be bypassed.
This issue affects Apache Tomcat Native: from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11; Apache Tomcat: from 11.0.0-M1 through 11.0.17, from 10.1.0-M7 through 10.1.51, from 9.0.83 through 9.0.114.
The following versions were EOL at the time the CVE was created but are
known to be affected: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39. Older EOL versions are not affected.
Apache Tomcat Native users are recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which fix the issue.
Apache Tomcat users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115 or later which fix the issue.
When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification or freshness checks on the OCSP response which could allow certificate revocation to be bypassed.
This issue affects Apache Tomcat Native: from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11; Apache Tomcat: from 11.0.0-M1 through 11.0.17, from 10.1.0-M7 through 10.1.51, from 9.0.83 through 9.0.114.
The following versions were EOL at the time the CVE was created but are
known to be affected: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39. Older EOL versions are not affected.
Apache Tomcat Native users are recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which fix the issue.
Apache Tomcat users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115 or later which fix the issue.
Vulnerability type
CWE-20
Improper Input Validation
Published: 17 Feb 2026 · Updated: 12 Mar 2026 · First seen: 6 Mar 2026