CVE-2026-74048
Description
A flaw was found in Apache Tomcat. When the server is configured to enforce FIPS (Federal Information Processing Standards) mode, a failure during FIPS activation causes Tomcat to log an error and continue running with standard non-FIPS cryptographic providers instead of terminating securely. This allows the application to process secure connections using unapproved or weaker cryptography, which may violate compliance mandates and weaken expected cryptographic protections.
Statement
A flaw was found in Apache Tomcat. When the OpenSSLLifecycleListener is configured to enforce FIPS mode and FIPS activation fails, Tomcat logs an error and continues running using non-FIPS JSSE cryptography rather than failing securely and terminating. An unauthenticated remote attacker can exploit this condition by establishing connections that use unapproved, non-compliant, or weaker cryptographic ciphers and algorithms, violating compliance mandates and degrading expected cryptographic assurances within the context of the running Tomcat daemon.
Mitigation
Configure automated startup monitoring or health-check scripts to verify Tomcat logs for OpenSSLLifecycleListener FIPS activation errors and terminate the process immediately upon failure, or ensure the underlying host operating system and JVM enforce FIPS mode globally.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.7 | N/A | 6.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | Low |
| Privileges Required | None | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | High |
| Integrity Impact | None | N/A | None |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Understanding the Weakness (CWE)
Integrity,Other
Technical Impact: Modify Application Data; Alter Execution Logic
The application could be placed in an insecure state that may allow an attacker to modify sensitive data or allow unintended logic to be executed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
