{"schema_version":"1.9.0","id":"CVE-2026-24734","published":"2026-02-17T18:53:12.228Z","modified":"2026-08-12T03:51:27.890030824Z","aliases":["BIT-tomcat-2026-24734","GHSA-mgp5-rv84-w37q"],"related":["ALSA-2026:19054","ALSA-2026:26323","CGA-jhgm-fwmv-jchq","SUSE-SU-2026:0877-1","SUSE-SU-2026:0890-1","SUSE-SU-2026:0932-1","SUSE-SU-2026:20926-1","SUSE-SU-2026:20982-1","openSUSE-SU-2026:10305-1","openSUSE-SU-2026:10306-1","openSUSE-SU-2026:10307-1","openSUSE-SU-2026:20350-1","openSUSE-SU-2026:20414-1","openSUSE-SU-2026:20444-1"],"summary":"Apache Tomcat Native, Apache Tomcat: OCSP revocation bypass","details":"Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat.\n\nWhen using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification or freshness checks on the OCSP response which could allow certificate revocation to be bypassed.\n\nThis issue affects Apache Tomcat Native:  from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11; Apache Tomcat: from 11.0.0-M1 through 11.0.17, from 10.1.0-M7 through 10.1.51, from 9.0.83 through 9.0.114.\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39. Older EOL versions are not affected.\n\nApache Tomcat Native users are recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which fix the issue.\n\nApache Tomcat users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115 or later which fix the issue.","affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/tomcat","events":[{"introduced":"be97b0e06e77226aea5eb2a7b448f1d53bda2aa1"},{"fixed":"fd3e7b16a7ead52f696b827178333f9a00696d25"},{"introduced":"934df02dc68e72b95a38f372017f1b89b0d13a76"},{"fixed":"45d567367df1dce8417fa1408b3ee3e290b48030"},{"introduced":"6c56147c3966fde5ae34aab2b253593e8700a28c"},{"fixed":"27c50670878728255730533129c4a53344191605"},{"introduced":"f2ab9ac8bc3f40ee9b2cb50b030c99df927f0429"},{"last_affected":"de714a23642a4d0baef342db6762a7f7a550d82c"}],"database_specific":{"cpe":["cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.1.0:milestone1:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.1.0:milestone10:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.1.0:milestone11:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.1.0:milestone12:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.1.0:milestone13:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.1.0:milestone14:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.1.0:milestone15:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.1.0:milestone16:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.1.0:milestone17:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.1.0:milestone18:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.1.0:milestone19:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.1.0:milestone2:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.1.0:milestone20:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.1.0:milestone3:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.1.0:milestone4:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.1.0:milestone5:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.1.0:milestone6:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.1.0:milestone7:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.1.0:milestone8:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:10.1.0:milestone9:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:11.0.0:milestone1:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:11.0.0:milestone10:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:11.0.0:milestone11:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:11.0.0:milestone12:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:11.0.0:milestone13:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:11.0.0:milestone14:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:11.0.0:milestone15:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:11.0.0:milestone16:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:11.0.0:milestone17:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:11.0.0:milestone18:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:11.0.0:milestone19:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:11.0.0:milestone2:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:11.0.0:milestone20:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:11.0.0:milestone21:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:11.0.0:milestone22:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:11.0.0:milestone23:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:11.0.0:milestone24:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:11.0.0:milestone25:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:11.0.0:milestone26:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:11.0.0:milestone3:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:11.0.0:milestone4:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:11.0.0:milestone5:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:11.0.0:milestone6:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:11.0.0:milestone7:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:11.0.0:milestone8:*:*:*:*:*:*","cpe:2.3:a:apache:tomcat:11.0.0:milestone9:*:*:*:*:*:*"],"extracted_events":[{"introduced":"9.0.83"},{"fixed":"9.0.115"},{"introduced":"10.1.1"},{"fixed":"10.1.52"},{"introduced":"11.0.1"},{"fixed":"11.0.18"},{"introduced":"10.1.0-milestone1"},{"last_affected":"10.1.0-milestone1"},{"introduced":"10.1.0-milestone10"},{"last_affected":"10.1.0-milestone10"},{"introduced":"10.1.0-milestone11"},{"last_affected":"10.1.0-milestone11"},{"introduced":"10.1.0-milestone12"},{"last_affected":"10.1.0-milestone12"},{"introduced":"10.1.0-milestone13"},{"last_affected":"10.1.0-milestone13"},{"introduced":"10.1.0-milestone14"},{"last_affected":"10.1.0-milestone14"},{"introduced":"10.1.0-milestone15"},{"last_affected":"10.1.0-milestone15"},{"introduced":"10.1.0-milestone16"},{"last_affected":"10.1.0-milestone16"},{"introduced":"10.1.0-milestone17"},{"last_affected":"10.1.0-milestone17"},{"introduced":"10.1.0-milestone18"},{"last_affected":"10.1.0-milestone18"},{"introduced":"10.1.0-milestone19"},{"last_affected":"10.1.0-milestone19"},{"introduced":"10.1.0-milestone2"},{"last_affected":"10.1.0-milestone2"},{"introduced":"10.1.0-milestone20"},{"last_affected":"10.1.0-milestone20"},{"introduced":"10.1.0-milestone3"},{"last_affected":"10.1.0-milestone3"},{"introduced":"10.1.0-milestone4"},{"last_affected":"10.1.0-milestone4"},{"introduced":"10.1.0-milestone5"},{"last_affected":"10.1.0-milestone5"},{"introduced":"10.1.0-milestone6"},{"last_affected":"10.1.0-milestone6"},{"introduced":"10.1.0-milestone7"},{"last_affected":"10.1.0-milestone7"},{"introduced":"10.1.0-milestone8"},{"last_affected":"10.1.0-milestone8"},{"introduced":"10.1.0-milestone9"},{"last_affected":"10.1.0-milestone9"},{"introduced":"11.0.0-milestone1"},{"last_affected":"11.0.0-milestone1"},{"introduced":"11.0.0-milestone10"},{"last_affected":"11.0.0-milestone10"},{"introduced":"11.0.0-milestone11"},{"last_affected":"11.0.0-milestone11"},{"introduced":"11.0.0-milestone12"},{"last_affected":"11.0.0-milestone12"},{"introduced":"11.0.0-milestone13"},{"last_affected":"11.0.0-milestone13"},{"introduced":"11.0.0-milestone14"},{"last_affected":"11.0.0-milestone14"},{"introduced":"11.0.0-milestone15"},{"last_affected":"11.0.0-milestone15"},{"introduced":"11.0.0-milestone16"},{"last_affected":"11.0.0-milestone16"},{"introduced":"11.0.0-milestone17"},{"last_affected":"11.0.0-milestone17"},{"introduced":"11.0.0-milestone18"},{"last_affected":"11.0.0-milestone18"},{"introduced":"11.0.0-milestone19"},{"last_affected":"11.0.0-milestone19"},{"introduced":"11.0.0-milestone2"},{"last_affected":"11.0.0-milestone2"},{"introduced":"11.0.0-milestone20"},{"last_affected":"11.0.0-milestone20"},{"introduced":"11.0.0-milestone21"},{"last_affected":"11.0.0-milestone21"},{"introduced":"11.0.0-milestone22"},{"last_affected":"11.0.0-milestone22"},{"introduced":"11.0.0-milestone23"},{"last_affected":"11.0.0-milestone23"},{"introduced":"11.0.0-milestone24"},{"last_affected":"11.0.0-milestone24"},{"introduced":"11.0.0-milestone25"},{"last_affected":"11.0.0-milestone25"},{"introduced":"11.0.0-milestone26"},{"last_affected":"11.0.0-milestone26"},{"introduced":"11.0.0-milestone3"},{"last_affected":"11.0.0-milestone3"},{"introduced":"11.0.0-milestone4"},{"last_affected":"11.0.0-milestone4"},{"introduced":"11.0.0-milestone5"},{"last_affected":"11.0.0-milestone5"},{"introduced":"11.0.0-milestone6"},{"last_affected":"11.0.0-milestone6"},{"introduced":"11.0.0-milestone7"},{"last_affected":"11.0.0-milestone7"},{"introduced":"11.0.0-milestone8"},{"last_affected":"11.0.0-milestone8"},{"introduced":"11.0.0-milestone9"},{"last_affected":"11.0.0-milestone9"}],"source":["CPE_RANGE","CPE_STRING"]}}],"versions":["10.1.0-milestone1","10.1.0-milestone10","10.1.0-milestone11","10.1.0-milestone12","10.1.0-milestone13","10.1.0-milestone14","10.1.0-milestone15","10.1.0-milestone16","10.1.0-milestone17","10.1.0-milestone18","10.1.0-milestone19","10.1.0-milestone2","10.1.0-milestone20","10.1.0-milestone3","10.1.0-milestone4","10.1.0-milestone5","10.1.0-milestone6","10.1.0-milestone7","10.1.0-milestone8","10.1.0-milestone9","11.0.0-milestone1","11.0.0-milestone10","11.0.0-milestone11","11.0.0-milestone12","11.0.0-milestone13","11.0.0-milestone14","11.0.0-milestone15","11.0.0-milestone16","11.0.0-milestone17","11.0.0-milestone18","11.0.0-milestone19","11.0.0-milestone2","11.0.0-milestone20","11.0.0-milestone21","11.0.0-milestone22","11.0.0-milestone23","11.0.0-milestone24","11.0.0-milestone25","11.0.0-milestone26","11.0.0-milestone3","11.0.0-milestone4","11.0.0-milestone5","11.0.0-milestone6","11.0.0-milestone7","11.0.0-milestone8","11.0.0-milestone9"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-24734.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/apache/tomcat-native","events":[{"introduced":"998746966815e1ae105cba9f2681d37cc30249bc"},{"fixed":"889f7ef35155df1fc0947c427b944fa738da5fbe"},{"introduced":"39c19afe4a3df7ea4fda778d82dc25bd494a110c"},{"fixed":"ef01736dc00d154f9d6622b796cf121929dfca64"}],"database_specific":{"cpe":"cpe:2.3:a:apache:tomcat_native:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.3.0"},{"fixed":"1.3.5"},{"introduced":"2.0.0"},{"fixed":"2.0.12"}],"source":"CPE_RANGE"}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-24734.json"}}],"references":[{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24734.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19054"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26323"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36790"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:5611"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:5612"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:6569"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8334"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-24734"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24734.json"},{"type":"ADVISORY","url":"https://lists.apache.org/thread/292dlmx3fz1888v6v16221kpozq56gml"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24734"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2440426"}],"database_specific":{"cna_assigner":"apache","cwe_ids":["CWE-20"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24734.json","unresolved_ranges":[{"extracted_events":[{"introduced":"1.1.23"},{"last_affected":"1.1.34"},{"introduced":"1.2.0"},{"last_affected":"1.2.39"},{"introduced":"1.3.0"},{"last_affected":"1.3.4"},{"introduced":"2.0.0"},{"last_affected":"2.0.11"},{"introduced":"11.0.0-M1"},{"last_affected":"11.0.17"},{"introduced":"10.1.0-M7"},{"last_affected":"10.1.51"},{"introduced":"9.0.83"},{"last_affected":"9.0.114"}],"source":"AFFECTED_FIELD"},{"extracted_events":[{"introduced":"1.3.0"},{"fixed":"1.3.4"},{"introduced":"2.0.0"},{"fixed":"2.0.11"},{"introduced":"11.0.0-M1"},{"fixed":"11.0.17"},{"introduced":"10.1.0-M7"},{"fixed":"10.1.51"},{"introduced":"9.0.83"},{"fixed":"9.0.114"},{"introduced":"1.1.23"},{"fixed":"1.1.34"},{"introduced":"1.2.0"},{"fixed":"1.2.39"}],"source":"DESCRIPTION"}]},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"}]}