Critical Certificate Revocation Bypass in Tomcat9 - Important Update Required
Summary
ALSA-2026:25341: Important: tomcat9 update. Affects tomcat9 versions < 1:9.0.117-1.el10_2.alma.1. Fixed in 1:9.0.117-1.el10_2.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Tomcat9 is a widely used open-source implementation of the Java Servlet, JavaServer Pages, and Java Expression Language technologies. It is designed to serve as a web server and servlet container for Java applications. The package includes various components such as the core server, admin web applications, documentation web applications, and API libraries. This vulnerability specifically affects Tomcat9 due to improper validation of OCSP responses, which can lead to certificate revocation bypass.
Vulnerability Detail
The vulnerability arises from improper validation of Online Certificate Status Protocol (OCSP) responses in Tomcat9. This flaw allows attackers to exploit the system by bypassing certificate revocation checks, potentially leading to unauthorized access or man-in-the-middle attacks. The vulnerability is critical as it undermines the security of SSL/TLS communications, making it easier for malicious actors to impersonate legitimate services.
How To Fix
Minimum fixed version
1:9.0.117-1.el10_2.alma.1
This is the first release that contains the fix.
sudo dnf update tomcat9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable OCSP checking in your Tomcat9 configuration. However, this is not recommended as it may expose your application to security risks. Instead, it is advisable to apply the patch as soon as possible.
Conclusion
The Tomcat9 vulnerability related to improper OCSP response validation poses significant security risks. It is crucial to update to the patched version to mitigate these risks and ensure the integrity of your web applications. Regular monitoring for vulnerabilities using tools like Vulert can help maintain security in your software.
See every vulnerability recorded for tomcat9 →
FAQ
The vulnerability allows attackers to bypass certificate revocation checks, which can lead to unauthorized access and potential data breaches.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider disabling OCSP checking as a temporary workaround, but be aware of the associated risks.
Yes, this vulnerability specifically affects Tomcat9 due to its improper OCSP response validation.
More details can be found in the advisory published on the AlmaLinux GitHub repository: https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux10/ALSA-2026:25341.json.
Related vulnerabilities
Recent vulnerabilities recorded for tomcat9.
