CVE-2026-24734: 
Java vulnerability analysis and mitigation

CVE-2026-24734 is an Improper Input Validation / Improper Certificate Validation vulnerability in Apache Tomcat Native and Apache Tomcat that allows certificate revocation to be bypassed when using an OCSP responder. When processing OCSP responses, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) failed to complete verification or freshness checks, enabling revoked certificates to be accepted as valid. Affected versions include Apache Tomcat Native 1.3.0–1.3.4 and 2.0.0–2.0.11, and Apache Tomcat 9.0.83–9.0.114, 10.1.0-M7–10.1.51, and 11.0.0-M1–11.0.17. The vulnerability was published on February 17, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified under CWE-20 (Improper Input Validation) and CWE-295 (Improper Certificate Validation). When Tomcat is configured to use an OCSP responder for certificate revocation checking, the OCSP response was not subjected to complete verification or freshness (nonce/time) checks, meaning a stale or otherwise invalid OCSP response could be accepted. This allows an attacker presenting a revoked client certificate to bypass the revocation check entirely, as Tomcat would incorrectly treat the certificate as valid. The attack is network-based, requires no authentication, no user interaction, and no special privileges — making it exploitable by any remote party who can present a TLS client certificate to an affected Tomcat instance configured with OCSP (Red Hat Bugzilla, Apache Mailing List).

Successful exploitation allows an attacker to authenticate to a Tomcat server using a revoked certificate that should have been rejected, effectively bypassing a critical security control. The primary impact is on integrity (CVSS integrity: High), as the certificate-based access control mechanism is subverted — there is no direct confidentiality or availability impact. In environments relying on mutual TLS (mTLS) with certificate revocation for access control, this could allow unauthorized users or compromised identities to gain access to protected resources, potentially enabling lateral movement within the application environment (Red Hat CVE, Red Hat Bugzilla).

1. Reconnaissance: Identify Apache Tomcat instances configured with mutual TLS (mTLS) and OCSP-based certificate revocation checking, running affected versions (Tomcat 9.0.83–9.0.114, 10.1.0-M7–10.1.51, or 11.0.0-M1–11.0.17, or Tomcat Native 1.3.0–1.3.4 / 2.0.0–2.0.11).
2. Obtain a revoked certificate: Acquire a client certificate that has been revoked by the issuing Certificate Authority (CA) — for example, a previously valid certificate whose private key was compromised or that was administratively revoked.
3. Initiate TLS handshake: Present the revoked client certificate during the TLS handshake to the target Tomcat server. Because Tomcat does not perform complete verification or freshness checks on the OCSP response, the revocation status is not properly validated.
4. Bypass revocation check: The server accepts the revoked certificate as valid, granting the attacker access to resources protected by certificate-based authentication.
5. Access protected resources: With the authentication bypass achieved, the attacker can interact with the application as if they held a valid, non-revoked certificate, potentially accessing sensitive data or functionality (Red Hat Bugzilla, Red Hat CVE).

• Logs: Tomcat access logs showing successful TLS client certificate authentication from certificates that should have been rejected; absence of OCSP verification error messages in catalina.out or SSL debug logs when revoked certificates are presented.
• Network: Unexpected or absent OCSP request traffic from the Tomcat server to the OCSP responder URL during client certificate validation (indicating checks are not being performed or responses are being accepted without validation).
• Configuration: Tomcat server.xml or Tomcat Native configuration with certificateVerification="required" and an OCSP responder configured — these deployments are the attack surface.
• Certificate: Authentication events in application logs tied to certificate serial numbers that appear in the CA's Certificate Revocation List (CRL) or OCSP revocation database.

Apache has released patched versions addressing this vulnerability: upgrade Apache Tomcat Native to 1.3.5 or later or 2.0.12 or later, and upgrade Apache Tomcat to 9.0.115 or later, 10.1.52 or later, or 11.0.18 or later (Red Hat Bugzilla, Apache Mailing List). Red Hat has issued errata RHSA-2026:5611 and RHSA-2026:5612 for Red Hat JBoss Web Server 6.2, and RHSA-2026:19054 for Red Hat Enterprise Linux 10. As a temporary workaround if immediate patching is not possible, disable OCSP responder functionality in Tomcat's SSL configuration until the patch can be applied, and consider using CRL-based revocation checking as an alternative. Organizations should also audit certificate authentication logs to identify any potentially revoked certificates that may have been accepted during the vulnerability window.

The vulnerability received broad vendor acknowledgment, with Red Hat, IBM, Oracle, Atlassian, Dell, SAP, Amazon Web Services, openSUSE, Mageia, Debian, and AlmaLinux all issuing advisories or security bulletins referencing CVE-2026-24734 (Oracle CPU April 2026, Red Hat CVE). IBM published multiple bulletins covering affected products including Watson Speech Services Cartridge, DevOps Solution Workbench, API Connect, and Storage Defender Copy Data Management. Security news outlets including SecurityOnline.info and Heise covered the vulnerability in the context of broader Apache Tomcat patch releases. Community reaction was measured, with the vulnerability noted as significant for mTLS-dependent deployments but not generating widespread alarm given the absence of public exploits.