Product · Apache Software Foundation

Apache Tomcat Native

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

Critical 9.1

CVE-2026-29145 Public exploit

Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0…

Apache Software Foundation Apache Tomcat Apache Tomcat Native org.apache.tomcat:tomcat Debian Ubuntu Alpine Maven

Apr 9, 2026