CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Jun 17, 2026 · NIST NVD

   Updated

   CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue.

2. Oct 15, 2026 · Apache Software Foundation

   Detected

   Named on the public Apache Software Foundation page.

Affected

• cpe apache/tomcatversion unspecified
• cpe apache/tomcat11.0.0

Sources

• Apache Software FoundationVendor advisoryCVE-2026-34500

  Named on the public Apache Software Foundation page.

  tomcat.apache.org
• CVE.orgVulnerability recordCVE-2026-34500

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-34500

  CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116. Users are recommend

  nvd.nist.gov

References

• Mailing List · openwall.com
• Vendor Advisory · lists.apache.org