CVE-2026-24734: Apache Tomcat Auth Bypass Vulnerability

CVE-2026-24734 Overview

CVE-2026-24734 is an Improper Input Validation vulnerability affecting Apache Tomcat Native and Apache Tomcat. When using an OCSP (Online Certificate Status Protocol) responder, Tomcat Native and Tomcat's FFM port of the Tomcat Native code failed to complete verification or freshness checks on the OCSP response. This critical oversight could allow attackers to bypass certificate revocation, potentially enabling the use of compromised or revoked certificates in TLS communications.

Critical Impact

Certificate revocation bypass vulnerability allows attackers to use revoked certificates, undermining the entire PKI trust chain and enabling man-in-the-middle attacks or impersonation of revoked entities.

Affected Products

• Apache Tomcat Native: versions 1.3.0 through 1.3.4
• Apache Tomcat Native: versions 2.0.0 through 2.0.11
• Apache Tomcat: versions 11.0.0-M1 through 11.0.17
• Apache Tomcat: versions 10.1.0-M7 through 10.1.51
• Apache Tomcat: versions 9.0.83 through 9.0.114
• Apache Tomcat Native (EOL): versions 1.1.23 through 1.1.34
• Apache Tomcat Native (EOL): versions 1.2.0 through 1.2.39

Discovery Timeline

• 2026-02-17 - CVE-2026-24734 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-24734

Vulnerability Analysis

This vulnerability stems from inadequate validation of OCSP responses within Apache Tomcat Native's SSL/TLS implementation. OCSP is a protocol used to check the revocation status of X.509 digital certificates in real-time. When a client or server connects using TLS, OCSP responses should be validated to ensure certificates have not been revoked by the issuing Certificate Authority.

The vulnerability affects both the native implementation and Tomcat's Foreign Function & Memory (FFM) API port of the Tomcat Native code. When OCSP stapling or OCSP checking is enabled, the affected versions fail to properly verify that OCSP responses are authentic and current. This means an attacker could present a stale or manipulated OCSP response, allowing a revoked certificate to be accepted as valid.

The weakness is classified as CWE-20 (Improper Input Validation), as the root cause involves insufficient validation of externally supplied OCSP response data before making trust decisions.

Root Cause

The root cause is improper input validation in the OCSP response handling code. Specifically, the implementation does not properly verify:

1. OCSP Response Authenticity - The signature on the OCSP response may not be fully validated against trusted responders
2. Freshness Checks - The thisUpdate and nextUpdate fields in OCSP responses are not properly checked to ensure the response is current and not stale

This allows an attacker to replay old OCSP responses from before a certificate was revoked, or potentially craft responses that bypass revocation checks entirely.

Attack Vector

An attacker exploiting this vulnerability would need to position themselves to intercept or manipulate TLS connections. The attack scenario involves:

1. Obtaining a certificate that has been legitimately revoked (e.g., due to key compromise)
2. Capturing an OCSP response from before the revocation occurred
3. Presenting the revoked certificate along with the stale OCSP response during TLS handshake
4. The vulnerable Tomcat instance accepts the revoked certificate due to inadequate freshness validation

This vulnerability is particularly concerning in environments where certificate revocation is critical for security, such as financial services, healthcare, or government applications where compromised credentials must be immediately invalidated.

Detection Methods for CVE-2026-24734

Indicators of Compromise

• Unexpected acceptance of certificates that should be revoked according to CRL or OCSP records
• TLS connections established with certificates that have been reported as compromised
• OCSP response timestamps significantly older than the current time being accepted
• Audit log discrepancies showing certificate validation passing for known-revoked certificates

Detection Strategies

• Review Apache Tomcat and Tomcat Native version inventory to identify instances running affected versions (1.3.0-1.3.4, 2.0.0-2.0.11 for Native; 11.0.0-M1 through 11.0.17, 10.1.0-M7 through 10.1.51, 9.0.83 through 9.0.114 for Tomcat)
• Implement certificate transparency monitoring to detect usage of revoked certificates
• Enable detailed SSL/TLS handshake logging to capture OCSP response handling events
• Deploy network traffic analysis to identify connections using certificates on revocation lists

Monitoring Recommendations

• Configure alerting for any certificate validation anomalies in Tomcat access and error logs
• Monitor Certificate Transparency logs for certificates associated with your domains
• Implement periodic certificate status checks independent of OCSP to validate revocation status
• Review TLS connection metadata for connections using certificates with old issuance or renewal dates

How to Mitigate CVE-2026-24734

Immediate Actions Required

• Upgrade Apache Tomcat Native to version 1.3.5 or later, or 2.0.12 or later
• Upgrade Apache Tomcat to version 11.0.18 or later, 10.1.52 or later, or 9.0.115 or later
• Review all TLS configurations to identify OCSP-dependent deployments requiring priority patching
• Consider temporarily disabling OCSP stapling if immediate patching is not feasible, understanding this may impact certificate validation capabilities

Patch Information

Apache has released patched versions that properly implement OCSP response verification and freshness checks:

For detailed information about the fix, refer to the Apache Thread Discussion.

Workarounds

• If upgrading is not immediately possible, consider implementing CRL (Certificate Revocation List) checking as an additional validation layer
• Deploy a reverse proxy or load balancer with properly implemented OCSP validation in front of affected Tomcat instances
• Implement network-level controls to restrict access to services relying on certificate-based authentication until patches are applied
• Enable additional logging for SSL/TLS operations to detect potential exploitation attempts

# Example: Check current Tomcat Native version
# Navigate to Tomcat installation directory
cd $CATALINA_HOME
# Check native library version in logs or via native-jni-lib
grep -i "APR/native" logs/catalina.out

# Verify Tomcat version
./bin/version.sh