CVE-2026-29145
Critical · 9.1CVSS
9.1
EPSS
0.7%
Published
Apr 9, 2026
CISA due date
—
The record
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13. Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | tomcat | 0 | 9.0.117-160000.1.1 |
| openSUSE:Leap 16.0 | tomcat10 | 0 | 10.1.54-160000.1.1 |
| openSUSE:Leap 16.0 | tomcat11 | 0 | 11.0.21-160000.1.1 |
| openSUSE:Tumbleweed | tomcat | 0 | 9.0.117-1.1 |
| openSUSE:Tumbleweed | tomcat10 | 0 | 10.1.54-1.1 |
| openSUSE:Tumbleweed | tomcat11 | 0 | 11.0.21-1.1 |
Related vulnerabilities
- CVE-2026-43514 Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat. Also affects tomcat
- CVE-2026-43515 Improper Authorization vulnerability when multiple method constraints define an HTTP… Also affects tomcat
- CVE-2026-43513 Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. Also affects tomcat
- CVE-2026-41293 Improper Input Validation vulnerability in Apache Tomcat. Also affects tomcat
- CVE-2026-42498 Exposure of HTTP Authentication Header to unexpected hosts during WebSocket… Also affects tomcat
- CVE-2026-43512 DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache… Also affects tomcat
- CVE-2026-41284 Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. Also affects tomcat
- CVE-2026-34487 Insertion of Sensitive Information into Log File vulnerability in the cloud membership… Also affects tomcat