SB2026021766 - OCSP verification bypass in Apache Tomcat

Description

This security bulletin contains information about 1 vulnerability.

1) Improper authorization (CVE-ID: CVE-2026-24734)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to bypass authorization checks.

The vulnerability exists due to incomplete OCSP verification checks. When using an OCSP responder, Tomcat's FFM integration with OpenSSL does not complete verification or freshness checks on the OCSP response. A remote attacker can bypass certificate revocation and gain unauthorized access to the application. 

Remediation

Install update from vendor's website.

References

• https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.52
• https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.115
• https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.18
• https://lists.apache.org/thread/m2stn80hj4wvvncc55hjo0707rg8yl7p