SB20260409110 - Multiple vulnerabilities in Apache Tomcat (April 2026 release)

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Improper Certificate Validation (CVE-ID: CVE-2026-34500)

The vulnerability allows a remote user to bypass client certificate authentication.

The vulnerability exists due to improper certificate validation in CLIENT_CERT authentication when processing OCSP checks with FFM and soft-fail disabled. A remote user can present a certificate in affected scenarios to bypass client certificate authentication.

Only some scenarios using FFM are affected.

2) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-34487)

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to insertion of sensitive information into log output in the cloud membership for clustering component when writing log messages. A remote attacker can trigger log entries that expose the Kubernetes bearer token to disclose sensitive information.

3) Protection Mechanism Failure (CVE-ID: CVE-2026-34486)

The vulnerability allows a remote attacker to bypass the EncryptInterceptor.

The vulnerability exists due to an implementation error in the EncryptInterceptor when processing traffic protected by the fix for #VU125739 (CVE-2026-29146). A remote attacker can exploit the flawed handling to bypass the EncryptInterceptor.

4) Improper Encoding or Escaping of Output (CVE-ID: CVE-2026-34483)

The vulnerability allows a remote attacker to inject arbitrary JSON into the JSON access log.

The vulnerability exists due to incomplete escaping in the JSON access log when handling requests with non-default Connector attributes relaxedPathChars and/or relaxedQueryChars. A remote attacker can send a specially crafted request to inject arbitrary JSON into the JSON access log.

Only configurations using non-default values for relaxedPathChars and/or relaxedQueryChars are affected.

Remediation

Install update from vendor's website.

References

• https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.21
• https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.54
• https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.117