CVE-2026-74048None▾ SunlitNot Failing Securely ('Failing Open') vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the pro…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration.
This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.26, from 10.1.22 through 10.1.60, from 9.0.92 through 9.0.122.
Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.
apache_tomcat >= 11.0.0-M14 <= 11.0.26apache_tomcat >= 10.1.22 <= 10.1.60apache_tomcat >= 9.0.92 <= 9.0.122Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-74049NoneApache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE)
CVE-2026-80353NoneApache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector
CVE-2026-88041NoneApache Tomcat: HTTP/2 trailer header cross-contamination
CVE-2026-101296NoneApache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms
CVE-2026-101356NoneApache Tomcat: HTTP/2 request/response mix-up after error during async processing
CVE-2026-93446NoneApache Tomcat: Possible TLS 1.3 connection failures