Critical Security Update for Apache Tomcat: Certificate Revocation Bypass Vulnerability
Summary
ALSA-2026:26323: Important: tomcat security update. Affects tomcat versions < 1:9.0.117-1.el9_8. Fixed in 1:9.0.117-1.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is a widely used servlet container that implements the Java Servlet and JavaServer Pages (JSP) technologies. It serves as a platform for running Java applications and is known for its scalability, reliability, and support for various Java specifications. However, it has been identified that certain versions of Tomcat are vulnerable to a certificate revocation bypass due to improper OCSP response validation, which can compromise the security of applications relying on secure communications.
Vulnerability Detail
The vulnerability, identified as CVE-2026-24734, arises from Apache Tomcat's failure to properly validate OCSP (Online Certificate Status Protocol) responses. This flaw allows an attacker to bypass certificate revocation checks, potentially enabling them to use revoked certificates for malicious purposes. The ramifications include the risk of man-in-the-middle attacks, where an attacker could impersonate a legitimate server, leading to unauthorized access to sensitive data.
How To Fix
Minimum fixed version
1:9.0.117-1.el9_8
This is the first release that contains the fix.
sudo dnf update tomcatTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users may disable OCSP validation in their Tomcat configuration, but this is not recommended as it exposes the application to security risks. Instead, it is advisable to apply the patch as soon as possible.
Conclusion
The Apache Tomcat vulnerability CVE-2026-24734 poses significant security risks due to improper OCSP response validation. It is crucial for users to update to the patched version to mitigate these risks and protect their applications from potential attacks. Utilizing tools like Vulert can aid in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for tomcat →
FAQ
CVE-2026-24734 is a vulnerability in Apache Tomcat that allows for certificate revocation bypass due to improper OCSP response validation.
You can check your Tomcat version and compare it with the fixed version (1:9.0.117-1.el9_8). Additionally, using tools like Vulert can help monitor for vulnerabilities.
Not addressing this vulnerability can lead to man-in-the-middle attacks, where attackers can impersonate legitimate servers and access sensitive information.
Yes, Vulert provides a service that monitors open-source vulnerabilities in your software using a manifest file like package-lock.json, alerting you in real-time.
If immediate updates are not possible, consider implementing temporary workarounds, but prioritize applying the patch as soon as feasible to ensure security.
Related vulnerabilities
Recent vulnerabilities recorded for tomcat.
