CVE-2026-34500: 
Java vulnerability analysis and mitigation

CVE-2026-34500 is an authentication bypass vulnerability in Apache Tomcat where CLIENT_CERT authentication does not fail as expected in certain scenarios when soft fail is disabled and the Foreign Function & Memory (FFM) API is used. Specifically, OCSP checks may soft-fail even when soft-fail is explicitly disabled, allowing authentication to succeed when it should be rejected. The vulnerability affects Apache Tomcat 11.0.0-M14 through 11.0.20, 10.1.22 through 10.1.53, and 9.0.92 through 9.0.116. It was discovered by Haruki Oyama of Waseda University and disclosed on April 9, 2026. The CVSS v3.1 base score is 6.5 (Medium) (GitHub Advisory, Openwall OSS-Sec).

The root cause is classified under CWE-303 (Incorrect Implementation of Authentication Algorithm) and CWE-287 (Improper Authentication). The vulnerability specifically involves the tomcat-coyote-ffm Maven package — when Tomcat is configured to use the FFM (Foreign Function & Memory) API for TLS/SSL handling and CLIENT_CERT authentication is enabled with soft fail disabled, OCSP (Online Certificate Status Protocol) revocation checks may incorrectly soft-fail, allowing clients with invalid or revoked certificates to authenticate successfully. The attack vector is network-based, requires no privileges or user interaction, but has high attack complexity, as it requires a specific configuration (FFM enabled, soft fail disabled, CLIENT_CERT authentication in use) to be exploitable (GitHub Advisory, Openwall OSS-Sec).

Successful exploitation allows an unauthenticated attacker to bypass certificate-based client authentication controls, potentially gaining unauthorized access to applications and resources protected by CLIENT_CERT authentication. The primary impact is high confidentiality loss — an attacker could access sensitive data or functionality that should be restricted to authenticated certificate holders — with a low integrity impact from unauthorized operations. Availability is not directly impacted. The scope of affected assets is limited to Tomcat deployments using the specific FFM-based TLS configuration with CLIENT_CERT authentication and soft fail disabled (GitHub Advisory, Feedly).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.036% (0.000360), indicating a low near-term exploitation probability. The high attack complexity — requiring a specific Tomcat configuration combining FFM, CLIENT_CERT authentication, and disabled soft fail — limits the practical attack surface. The vulnerability was credited to researcher Haruki Oyama of Waseda University (Openwall OSS-Sec).

1. Reconnaissance: Identify Apache Tomcat instances running versions 9.0.92–9.0.116, 10.1.22–10.1.53, or 11.0.0-M14–11.0.20 that are configured to use CLIENT_CERT authentication with the FFM API (tomcat-coyote-ffm) and have soft fail disabled in their OCSP configuration.
2. Identify target endpoint: Locate application endpoints or resources protected by CLIENT_CERT authentication on the vulnerable Tomcat instance.
3. Craft TLS handshake: Initiate a TLS connection to the target server presenting a client certificate that would normally fail OCSP revocation checks (e.g., a revoked or otherwise invalid certificate).
4. Exploit OCSP soft-fail bug: Due to the FFM implementation flaw, the OCSP check soft-fails despite soft fail being disabled, causing Tomcat to treat the authentication as successful rather than rejecting the connection.
5. Gain unauthorized access: The attacker is authenticated to the application as if they held a valid certificate, gaining access to protected resources or functionality (GitHub Advisory, Openwall OSS-Sec).

• Network: Unexpected successful TLS connections from clients presenting certificates that should fail OCSP revocation checks; connections from clients with revoked certificates to CLIENT_CERT-protected endpoints.
• Logs: Tomcat access logs showing successful authentication events (200 responses) for requests that should have been rejected with 401 or 403 due to certificate validation failure; absence of OCSP-related error or rejection log entries when revoked certificates are used.
• Configuration Audit: Presence of tomcat-coyote-ffm JAR in the Tomcat installation alongside CLIENT_CERT authentication configuration with certificateVerification set to a non-soft-fail mode in server.xml or equivalent connector configuration.

Apache has released patched versions that resolve this issue: Apache Tomcat 11.0.21, 10.1.54, and 9.0.117. Users should upgrade to the appropriate patched version as soon as possible. As an interim measure until patching is complete, administrators can review and strengthen access controls and monitoring for authentication events on affected instances, or consider switching from the FFM-based TLS implementation to the standard JSSE implementation if operationally feasible. Red Hat has also addressed this in Red Hat JBoss Web Server 6.2.3 via RHSA-2026:20405 and RHSA-2026:20406 (GitHub Advisory, Red Hat Bugzilla).

The Apache Tomcat security team (Mark Thomas) disclosed the vulnerability via the oss-security mailing list on April 9, 2026, rating it as moderate severity (Openwall OSS-Sec). IBM subsequently issued advisories for affected products including IBM Business Automation Manager Open Editions, IBM Process Mining, and IBM API Connect (Red Hat Bugzilla). Security news outlets including GBHackers, SecurityOnline, and CyberPress covered the vulnerability as part of broader Apache Tomcat April 2026 security update coverage. Oracle also referenced the CVE in its May 2026 Critical Patch Update.