Critical Security Flaw in Apache Tomcat: Certificate Revocation Bypass
Summary
ALSA-2026:19054: Important: tomcat security update. Affects tomcat versions < 1:10.1.49-1.el10_2.1.alma.1. Fixed in 1:10.1.49-1.el10_2.1.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is a widely-used servlet container that implements the Java Servlet and JavaServer Pages (JSP) technologies. It serves as a platform for running Java applications and is known for its robustness and scalability. However, it has recently been identified that certain versions of Tomcat are vulnerable to a security issue that allows for certificate revocation bypass, potentially compromising the integrity of secure communications.
Vulnerability Detail
The vulnerability, identified as CVE-2026-24734, arises from improper validation of OCSP (Online Certificate Status Protocol) responses. This flaw can allow an attacker to bypass certificate revocation checks, leading to the possibility of using revoked certificates for secure communications. The implications of this vulnerability are significant, as it can undermine the trustworthiness of SSL/TLS connections, exposing users to man-in-the-middle attacks and other security risks.
How To Fix
Minimum fixed version
1:10.1.49-1.el10_2.1.alma.1
This is the first release that contains the fix.
sudo dnf update tomcatTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if you are unable to apply the patch immediately, consider disabling OCSP checks in your Tomcat configuration. However, this is not recommended as a long-term solution, as it may expose your application to security risks. Always prioritize applying the official patch as soon as possible.
Conclusion
The identified vulnerability in Apache Tomcat poses a significant risk to secure communications by allowing certificate revocation bypass. It is imperative for users of affected versions to update to the patched version promptly to safeguard their applications. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for tomcat →
FAQ
CVE-2026-24734 is a security vulnerability in Apache Tomcat that allows for certificate revocation bypass due to improper OCSP response validation.
This vulnerability can allow attackers to use revoked certificates, potentially compromising secure communications and exposing users to various security threats.
The vulnerability affects versions of Tomcat prior to 1:10.1.49-1.el10_2.1.alma.1. It is crucial to update to this version or later to mitigate the risk.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without any signup at Vulert Scanner.
If an immediate update is not possible, consider disabling OCSP checks as a temporary workaround, but be aware that this may expose your application to security risks.
Related vulnerabilities
Recent vulnerabilities recorded for tomcat.
