CVE-2026-34500
Gravedad CVSS v3.1:
MEDIA
Tipo:
CWE-287
Autenticación incorrecta
Fecha de publicación:
09/04/2026
Última modificación:
14/04/2026
Descripción
*** Pendiente de traducción *** CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat.<br />
<br />
This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116.<br />
<br />
Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue.
Impacto
Puntuación base 3.x
6.50
Gravedad 3.x
MEDIA
Productos y versiones vulnerables
| CPE | Desde | Hasta |
|---|---|---|
| cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* | 9.0.92 (incluyendo) | 9.0.117 (excluyendo) |
| cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* | 10.1.22 (incluyendo) | 10.1.54 (excluyendo) |
| cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* | 11.0.1 (incluyendo) | 11.0.21 (excluyendo) |
| cpe:2.3:a:apache:tomcat:11.0.0:milestone14:*:*:*:*:*:* | ||
| cpe:2.3:a:apache:tomcat:11.0.0:milestone15:*:*:*:*:*:* | ||
| cpe:2.3:a:apache:tomcat:11.0.0:milestone16:*:*:*:*:*:* | ||
| cpe:2.3:a:apache:tomcat:11.0.0:milestone17:*:*:*:*:*:* | ||
| cpe:2.3:a:apache:tomcat:11.0.0:milestone18:*:*:*:*:*:* | ||
| cpe:2.3:a:apache:tomcat:11.0.0:milestone19:*:*:*:*:*:* | ||
| cpe:2.3:a:apache:tomcat:11.0.0:milestone20:*:*:*:*:*:* | ||
| cpe:2.3:a:apache:tomcat:11.0.0:milestone21:*:*:*:*:*:* | ||
| cpe:2.3:a:apache:tomcat:11.0.0:milestone22:*:*:*:*:*:* | ||
| cpe:2.3:a:apache:tomcat:11.0.0:milestone23:*:*:*:*:*:* | ||
| cpe:2.3:a:apache:tomcat:11.0.0:milestone24:*:*:*:*:*:* | ||
| cpe:2.3:a:apache:tomcat:11.0.0:milestone25:*:*:*:*:*:* |
Para consultar la lista completa de nombres de CPE con productos y versiones, ver esta página