Summary
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.
Security Fix(es):
* tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation (CVE-2026-24734)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 10 | tomcat | 1:10.1.49-1.el10_2.1.alma.1 |
| AlmaLinux · 10 | tomcat-admin-webapps | 1:10.1.49-1.el10_2.1.alma.1 |
| AlmaLinux · 10 | tomcat-docs-webapp | 1:10.1.49-1.el10_2.1.alma.1 |
| AlmaLinux · 10 | tomcat-el-5.0-api | 1:10.1.49-1.el10_2.1.alma.1 |
| AlmaLinux · 10 | tomcat-jsp-3.1-api | 1:10.1.49-1.el10_2.1.alma.1 |
| AlmaLinux · 10 | tomcat-lib | 1:10.1.49-1.el10_2.1.alma.1 |
| AlmaLinux · 10 | tomcat-servlet-6.0-api | 1:10.1.49-1.el10_2.1.alma.1 |
| AlmaLinux · 10 | tomcat-webapps | 1:10.1.49-1.el10_2.1.alma.1 |
Vulnerabilities 1
-
High 7.4
Apache Tomcat Native, Apache Tomcat: OCSP revocation bypass
Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification or freshness checks on the OCSP response which could al…