Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Apache Tomcat: Certificate Revocation Bypass Vulnerability
published 4 months ago
Summary
Apache Tomcat users need to update their software to prevent hackers from bypassing certificate checks, which could allow unauthorized access to sensitive information. This update addresses a previously unknown security risk. Users should update to the latest version of Apache Tomcat as soon as possible.
What to do
- Update almalinux tomcat to version 1:9.0.117-1.el9_8.
- Update almalinux tomcat-admin-webapps to version 1:9.0.117-1.el9_8.
- Update almalinux tomcat-docs-webapp to version 1:9.0.117-1.el9_8.
- Update almalinux tomcat-el-3.0-api to version 1:9.0.117-1.el9_8.
- Update almalinux tomcat-jsp-2.3-api to version 1:9.0.117-1.el9_8.
- Update almalinux tomcat-lib to version 1:9.0.117-1.el9_8.
- Update almalinux tomcat-servlet-4.0-api to version 1:9.0.117-1.el9_8.
- Update almalinux tomcat-webapps to version 1:9.0.117-1.el9_8.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:9 | almalinux | tomcat |
< 1:9.0.117-1.el9_8 Fix: upgrade to 1:9.0.117-1.el9_8
|
| AlmaLinux:9 | almalinux | tomcat-admin-webapps |
< 1:9.0.117-1.el9_8 Fix: upgrade to 1:9.0.117-1.el9_8
|
| AlmaLinux:9 | almalinux | tomcat-docs-webapp |
< 1:9.0.117-1.el9_8 Fix: upgrade to 1:9.0.117-1.el9_8
|
| AlmaLinux:9 | almalinux | tomcat-el-3.0-api |
< 1:9.0.117-1.el9_8 Fix: upgrade to 1:9.0.117-1.el9_8
|
| AlmaLinux:9 | almalinux | tomcat-jsp-2.3-api |
< 1:9.0.117-1.el9_8 Fix: upgrade to 1:9.0.117-1.el9_8
|
| AlmaLinux:9 | almalinux | tomcat-lib |
< 1:9.0.117-1.el9_8 Fix: upgrade to 1:9.0.117-1.el9_8
|
| AlmaLinux:9 | almalinux | tomcat-servlet-4.0-api |
< 1:9.0.117-1.el9_8 Fix: upgrade to 1:9.0.117-1.el9_8
|
| AlmaLinux:9 | almalinux | tomcat-webapps |
< 1:9.0.117-1.el9_8 Fix: upgrade to 1:9.0.117-1.el9_8
|
Original advisory text
Important: tomcat security update
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.
Security Fix(es):
* tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation (CVE-2026-24734)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation (CVE-2026-24734)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://access.redhat.com/errata/RHSA-2026:26323 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-24734 Third Party Advisory
- https://bugzilla.redhat.com/2440426 Third Party Advisory
- https://errata.almalinux.org/9/ALSA-2026-26323.html Vendor Advisory
Timeline
Published16 Jun 2026
Updated25 Jun 2026
First seen25 Jun 2026
Sources
ALSA-2026:26323 · OSV
Track software like this
Free during beta