CVE-2026-34500
Description
A flaw was found in Apache Tomcat where OCSP-based certificate validation may incorrectly soft-fail during CLIENT_CERT authentication, even when soft-fail is disabled, under certain FFM-related execution paths. This can result in client certificates being accepted despite failed or unverifiable revocation checks, weakening certificate validation in specific mTLS configurations.
Statement
This flaw is rated Moderate rather than Important flaw because its impact is highly conditional and configuration-dependent, not broadly exploitable. The issue only manifests when CLIENT_CERT authentication, OCSP revocation checking, and soft-fail disabled are all explicitly configured, and even then only along specific execution paths involving the FFM API. There is no direct remote exploit primitive—an attacker would already need access to a client certificate that triggers an OCSP validation failure scenario (e.g., responder unavailability or malformed response) to potentially bypass revocation enforcement. Importantly, the vulnerability does not enable certificate forgery, private key compromise, or bypass of TLS authentication itself; it weakens enforcement of revocation status under edge conditions.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.9 | N/A | 6.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | None | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
