org.apache.tomcat:tomcat-coyote-ffm

3 results · Feed

• Medium 6.5
  CVE-2026-34500

  Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled

  CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116. …

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Apr 9, 2026
• Critical 9.1
  CVE-2026-29145 Public exploit

  Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled

  CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0…

  Apache Software Foundation Apache Tomcat Apache Tomcat Native thingsboard-tb-node Debian Ubuntu Alpine Wolfi Maven
  Apr 9, 2026
• High 7.4
  CVE-2026-24734

  Apache Tomcat Native, Apache Tomcat: OCSP revocation bypass

  Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification or freshness checks on the OCSP response which could al…

  Apache Software Foundation Apache Tomcat Apache Tomcat Native tomcat9 Debian Ubuntu Alpine Maven
  Feb 17, 2026