Improper authorization in Apache Tomcat - CVE-2026-24734

Vulnerability identifier: #VU122999

CSH Severity: Medium

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-24734

CWE-ID: CWE-285

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass authorization checks.

The vulnerability exists due to incomplete OCSP verification checks. When using an OCSP responder, Tomcat's FFM integration with OpenSSL does not complete verification or freshness checks on the OCSP response. A remote attacker can bypass certificate revocation and gain unauthorized access to the application. 

Apache Tomcat
Debian Linux
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Web and Scripting Module
openSUSE Leap
openEuler
Anolis OS
Storage Defender Copy Data Management
DevOps
CICS Transaction Gateway Desktop Edition
CICS Transaction Gateway for Multiplatforms
Oracle Communications Policy Management
MongoDB Enterprise Advanced with IBM
IBM Watson Discovery for IBM Cloud Pak for Data
Jira Service Management Data Center
IBM UrbanCode Release
Confluence Data Center
Oracle Communications Session Report Manager
Bitbucket Data Center
Jira Software Data Center
Bamboo Data Center
IBM Integration Bus
Datastax Enterprise with IBM
IBM Power Hardware Management Console (HMC)
Communications Unified Assurance
Oracle Utilities Testing Accelerator
Oracle Communications Element Manager
IBM Qradar SIEM
Oracle Commerce Guided Search
Oracle Hospitality Cruise Shipboard Property Management System
tomcat-admin-webapps
tomcat-jsvc
tomcat-help
tomcat
tomcat-doc
tomcat-docs-webapp
tomcat-el-3.0-api
tomcat-jsp-2.3-api
tomcat-lib
tomcat-servlet-4.0-api
tomcat-webapps
tomcat-embed
tomcat-servlet-4_0-api
tomcat-el-3_0-api
tomcat-javadoc
tomcat-jsp-2_3-api
tomcat (Red Hat package)
tomcat10-embed
tomcat10-jsvc
tomcat10-jsp-3_1-api
tomcat10-docs-webapp
tomcat10-lib
tomcat10-admin-webapps
tomcat10-servlet-6_0-api
tomcat10
tomcat10-doc
tomcat10-webapps
tomcat10-el-5_0-api
tomcat11-admin-webapps
tomcat11-docs-webapp
tomcat11-embed
tomcat11-webapps
tomcat11-jsp-4_0-api
tomcat11
tomcat11-lib
tomcat11-jsvc
tomcat11-el-6_0-api
tomcat11-doc
tomcat11-servlet-6_1-api
tomcat11 (Debian package)

Install updates from vendor's website.

Apache Tomcat - addressed in versions 9.0.115, 10.1.52, 11.0.18
Storage Defender Copy Data Management - update to 2.3.0.1
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.3.2
Jira Service Management Data Center - addressed in versions 10.3.17, 11.3.3
DevOps - update to 7.0.0.7
IBM Qradar SIEM - update to 7.5.0 Update Pack 16
Confluence Data Center - addressed in versions 9.2.20, 10.2.11
Bitbucket Data Center - addressed in versions 9.4.21, 10.2.4, 10.3.1
Jira Software Data Center - addressed in versions 9.12.32, 10.3.17, 11.3.3
Bamboo Data Center - addressed in versions 10.2.18, 12.1.6
MongoDB Enterprise Advanced with IBM - update to 1.16.0
Datastax Enterprise with IBM - update to 6.9.22
tomcat-admin-webapps - update to 9.0.115-1
tomcat-jsvc - update to 9.0.115-1
tomcat-help - update to 9.0.115-1
tomcat - update to 9.0.115-1
tomcat - update to 9.0.115-1
tomcat-doc - update to 9.0.115-1
tomcat-docs-webapp - update to 9.0.115-1
tomcat-el-3.0-api - update to 9.0.115-1
tomcat-jsp-2.3-api - update to 9.0.115-1
tomcat-lib - update to 9.0.115-1
tomcat-servlet-4.0-api - update to 9.0.115-1
tomcat-webapps - update to 9.0.115-1
tomcat-embed - update to 9.0.115-150200.102.1
tomcat-servlet-4_0-api - update to 9.0.115-150200.102.1
tomcat-el-3_0-api - update to 9.0.115-150200.102.1
tomcat-lib - update to 9.0.115-150200.102.1
tomcat-webapps - update to 9.0.115-150200.102.1
tomcat-javadoc - update to 9.0.115-150200.102.1
tomcat - update to 9.0.115-150200.102.1
tomcat-jsp-2_3-api - update to 9.0.115-150200.102.1
tomcat-jsvc - update to 9.0.115-150200.102.1
tomcat-docs-webapp - update to 9.0.115-150200.102.1
tomcat-admin-webapps - update to 9.0.115-150200.102.1
tomcat (Red Hat package) - update to 9.0.117-1.el9_8
tomcat10-embed - update to 10.1.52-150200.5.61.1
tomcat10-jsvc - update to 10.1.52-150200.5.61.1
tomcat10-jsp-3_1-api - update to 10.1.52-150200.5.61.1
tomcat10-docs-webapp - update to 10.1.52-150200.5.61.1
tomcat10-lib - update to 10.1.52-150200.5.61.1
tomcat10-admin-webapps - update to 10.1.52-150200.5.61.1
tomcat10-servlet-6_0-api - update to 10.1.52-150200.5.61.1
tomcat10 - update to 10.1.52-150200.5.61.1
tomcat10-doc - update to 10.1.52-150200.5.61.1
tomcat10-webapps - update to 10.1.52-150200.5.61.1
tomcat10-el-5_0-api - update to 10.1.52-150200.5.61.1
IBM Power Hardware Management Console (HMC) - addressed in versions 10.3.1063.2, 11.1.1111.5
tomcat11-admin-webapps - update to 11.0.18-150600.13.15.1
tomcat11-docs-webapp - update to 11.0.18-150600.13.15.1
tomcat11-embed - update to 11.0.18-150600.13.15.1
tomcat11-webapps - update to 11.0.18-150600.13.15.1
tomcat11-jsp-4_0-api - update to 11.0.18-150600.13.15.1
tomcat11 - update to 11.0.18-150600.13.15.1
tomcat11-lib - update to 11.0.18-150600.13.15.1
tomcat11-jsvc - update to 11.0.18-150600.13.15.1
tomcat11-el-6_0-api - update to 11.0.18-150600.13.15.1
tomcat11-doc - update to 11.0.18-150600.13.15.1
tomcat11-servlet-6_1-api - update to 11.0.18-150600.13.15.1
tomcat11 (Debian package) - update to 11.0.22-1~deb13u1

• https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.52
• https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.115
• https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.18
• https://lists.apache.org/thread/m2stn80hj4wvvncc55hjo0707rg8yl7p

• OCSP verification bypass in Apache Tomcat
• Anolis OS update for tomcat
• SUSE update for tomcat11
• SUSE update for tomcat10
• SUSE update for tomcat
• openEuler update for tomcat
• Multiple vulnerabilities in IBM Power Hardware Management Console (HMC)
• Multiple vulnerabilities in IBM DevOps Release
• IBM Integration Bus for z/OS update for Apache Tomcat
• Multiple vulnerabilities in Oracle Communications Session Report Manager
• Multiple vulnerabilities in Oracle Communications Element Manager
• Multiple vulnerabilities in Oracle Communications Policy Management
• Multiple vulnerabilities in Communications Unified Assurance
• Multiple vulnerabilities in Oracle Commerce Guided Search
• Improper authorization in Oracle Hospitality Cruise Shipboard Property Management System
• Multiple vulnerabilities in Oracle Utilities Testing Accelerator
• Bamboo Data Center update for tomcat-coyote
• Multiple vulnerabilities in IBM Watson Discovery Cartridge
• Multiple vulnerabilities in IBM Storage Defender Copy Data Management
• Multiple vulnerabilities in IBM DataStax Enterprise
• Multiple vulnerabilities in Confluence Data Center
• Debian update for tomcat11
• Red Hat Enterprise Linux 9 update for tomcat
• MongoDB Enterprise Advanced with IBM migrator update for Apache Tomcat Native
• Multiple vulnerabilities in Bitbucket Data Center
• Multiple vulnerabilities in IBM CICS Transaction Gateway for Multiplatforms
• Multiple vulnerabilities in CICS Transaction Gateway Desktop Edition
• Improper authorization in Jira Service Management Data Center
• Improper authorization in Jira Software Data Center
• Multiple vulnerabilities in IBM QRadar SIEM