cyfenced.com →

[ CVE-2026-74048 · Published 20 Oct 2026 ]

Vulnerability in Apache Software Foundation Apache Tomcat

Not scored yet EPSS <1%2 agency advisoriesFix available

[ Description ]Official description

Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.26, from 10.1.22 through 10.1.60, from 9.0.92 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.

[ Fixes ]Fixes and patches

[ Advisories ]Government CERT advisories

  • CERT-FRCERTFR-2026-AVI-1358

    Multiple vulnerabilities in Apache Tomcat Translated from French

    Multiple vulnerabilities have been discovered in Apache Tomcat. Some of them allow an attacker to cause a breach of data confidentiality, a security policy bypass and a security problem not specified by the vendor.

    CVE-2026-65183CVE-2026-88041CVE-2026-80353+6 more CVEs
  • BSI CERT-BundWID-SEC-2026-4066

    Apache Tomcat: Multiple vulnerabilities Translated from German

    CVE-2026-101356CVE-2026-88041CVE-2026-80353+5 more CVEs

[ References ]References