Failing Open Vulnerability in Apache Tomcat Affects Multiple Versions
CVE-2026-74048

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Tomcat
Vendor
CVE Published:
20 October 2026

What is CVE-2026-74048?

A failing open vulnerability has been identified in Apache Tomcat, affecting versions across multiple major releases. When the OpenSSLLifecycleListener is configured for FIPS mode and fails to activate properly, Apache Tomcat logs an error but fails to transition securely, continuing to operate using JSSE in non-FIPS mode. This misconfiguration could lead to unintended security exposures. To mitigate this issue, users should upgrade to the latest versions: 11.0.27, 10.1.61, or 9.0.123.

Affected Version(s)

Apache Tomcat 11.0.0-M14 <= 11.0.26

Apache Tomcat 10.1.22 <= 10.1.60

Apache Tomcat 9.0.92 <= 9.0.122

References

https://lists.apache.org/thread.html/v5ry0sx1c7x1wr5mx4cd...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

0xCc.zhang
.