{ "affected": [ { "ranges": [ { "database_specific": { "cpe": [ "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*", "cpe:2.3:a:apache:tomcat:10.1.0:-:*:*:*:*:*:*", "cpe:2.3:a:apache:tomcat:10.1.0:milestone10:*:*:*:*:*:*", "cpe:2.3:a:apache:tomcat:10.1.0:milestone11:*:*:*:*:*:*", "cpe:2.3:a:apache:tomcat:10.1.0:milestone12:*:*:*:*:*:*", "cpe:2.3:a:apache:tomcat:10.1.0:milestone13:*:*:*:*:*:*", "cpe:2.3:a:apache:tomcat:10.1.0:milestone14:*:*:*:*:*:*", "cpe:2.3:a:apache:tomcat:10.1.0:milestone15:*:*:*:*:*:*", "cpe:2.3:a:apache:tomcat:10.1.0:milestone16:*:*:*:*:*:*", "cpe:2.3:a:apache:tomcat:10.1.0:milestone17:*:*:*:*:*:*", "cpe:2.3:a:apache:tomcat:10.1.0:milestone18:*:*:*:*:*:*", "cpe:2.3:a:apache:tomcat:10.1.0:milestone19:*:*:*:*:*:*", "cpe:2.3:a:apache:tomcat:10.1.0:milestone20:*:*:*:*:*:*", "cpe:2.3:a:apache:tomcat:10.1.0:milestone7:*:*:*:*:*:*", "cpe:2.3:a:apache:tomcat:10.1.0:milestone8:*:*:*:*:*:*", "cpe:2.3:a:apache:tomcat:10.1.0:milestone9:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "9.0.83" }, { "fixed": "9.0.116" }, { "introduced": "10.1.1" }, { "fixed": "10.1.53" }, { "introduced": "11.0.0" }, { "fixed": "11.0.20" }, { "introduced": "10.1.0-NA" }, { "last_affected": "10.1.0-NA" }, { "introduced": "10.1.0-milestone10" }, { "last_affected": "10.1.0-milestone10" }, { "introduced": "10.1.0-milestone11" }, { "last_affected": "10.1.0-milestone11" }, { "introduced": "10.1.0-milestone12" }, { "last_affected": "10.1.0-milestone12" }, { "introduced": "10.1.0-milestone13" }, { "last_affected": "10.1.0-milestone13" }, { "introduced": "10.1.0-milestone14" }, { "last_affected": "10.1.0-milestone14" }, { "introduced": "10.1.0-milestone15" }, { "last_affected": "10.1.0-milestone15" }, { "introduced": "10.1.0-milestone16" }, { "last_affected": "10.1.0-milestone16" }, { "introduced": "10.1.0-milestone17" }, { "last_affected": "10.1.0-milestone17" }, { "introduced": "10.1.0-milestone18" }, { "last_affected": "10.1.0-milestone18" }, { "introduced": "10.1.0-milestone19" }, { "last_affected": "10.1.0-milestone19" }, { "introduced": "10.1.0-milestone20" }, { "last_affected": "10.1.0-milestone20" }, { "introduced": "10.1.0-milestone7" }, { "last_affected": "10.1.0-milestone7" }, { "introduced": "10.1.0-milestone8" }, { "last_affected": "10.1.0-milestone8" }, { "introduced": "10.1.0-milestone9" }, { "last_affected": "10.1.0-milestone9" } ], "source": [ "CPE_RANGE", "CPE_STRING" ] }, "events": [ { "introduced": "be97b0e06e77226aea5eb2a7b448f1d53bda2aa1" }, { "fixed": "d2c7dce5e94d6d1d81ad7d66402140b1c1962a53" }, { "introduced": "934df02dc68e72b95a38f372017f1b89b0d13a76" }, { "fixed": "f3d5786aa1bd6c2a78d666afc89b2a4570f66593" }, { "introduced": "56e547d387ab49f688c93fe9ca082b1b5d94deed" }, { "fixed": "1c65de6f27a3bac481514e56e3637785b65a4f2c" }, { "introduced": "e9d17cddc285615807ec5fef09240777436b25dc" }, { "last_affected": "02d546ba3c553c74ff1a99ecc166a6ff9c501ba8" } ], "repo": "https://github.com/apache/tomcat", "type": "GIT" } ], "versions": [ "10.1.0-NA", "10.1.0-milestone10", "10.1.0-milestone11", "10.1.0-milestone12", "10.1.0-milestone13", "10.1.0-milestone14", "10.1.0-milestone15", "10.1.0-milestone16", "10.1.0-milestone17", "10.1.0-milestone18", "10.1.0-milestone19", "10.1.0-milestone20", "10.1.0-milestone7", "10.1.0-milestone8", "10.1.0-milestone9" ] }, { "ranges": [ { "database_specific": { "cpe": "cpe:2.3:a:apache:tomcat_native:*:*:*:*:*:*:*:*", "extracted_events": [ { "introduced": "1.1.23" }, { "fixed": "1.3.7" }, { "introduced": "2.0.0" }, { "fixed": "2.0.14" } ], "source": "CPE_RANGE" }, "events": [ { "introduced": "71090a48b31816e3d5a0646be5c3e7b2b533bf07" }, { "fixed": "c51879b3c49b35807d70f5667cf3230035babd97" }, { "introduced": "39c19afe4a3df7ea4fda778d82dc25bd494a110c" }, { "fixed": "ad89e96bdc47f9a75dbafb04ec08d60e9042708b" } ], "repo": "https://github.com/apache/tomcat-native", "type": "GIT" } ] } ], "database_specific": { "cna_assigner": "apache", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29145.json", "unresolved_ranges": [ { "extracted_events": [ { "introduced": "11.0.0-M1" }, { "last_affected": "11.0.18" }, { "introduced": "10.1.0-M7" }, { "last_affected": "10.1.52" }, { "introduced": "9.0.83" }, { "last_affected": "9.0.115" }, { "introduced": "1.1.23" }, { "last_affected": "1.1.34" }, { "introduced": "1.2.0" }, { "last_affected": "1.2.39" }, { "introduced": "1.3.0" }, { "last_affected": "1.3.6" }, { "introduced": "2.0.0" }, { "last_affected": "2.0.13" } ], "source": "AFFECTED_FIELD" }, { "extracted_events": [ { "introduced": "11.0.0-M1" }, { "fixed": "11.0.18" }, { "introduced": "10.1.0-M7" }, { "fixed": "10.1.52" }, { "introduced": "9.0.83" }, { "fixed": "9.0.115" }, { "introduced": "1.1.23" }, { "fixed": "1.1.34" }, { "introduced": "1.2.0" }, { "fixed": "1.2.39" }, { "introduced": "1.3.0" }, { "fixed": "1.3.6" }, { "introduced": "2.0.0" }, { "fixed": "2.0.13" } ], "source": "DESCRIPTION" } ] }, "details": "CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13.\n\nUsers are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.", "id": "CVE-2026-29145", "modified": "2026-07-15T01:48:57.487345587Z", "published": "2026-04-09T19:20:24.601Z", "references": [ { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2026/04/09/23" }, { "type": "ADVISORY", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29145.json" }, { "type": "ADVISORY", "url": "https://lists.apache.org/thread/yz5fxmhd2j43wgqykssdo7kltws57jfz" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29145" } ], "schema_version": "1.8.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "type": "CVSS_V3" } ], "summary": "Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled" }