Skip to content
VulniPulse
Sign in
Highest advisory severityCritical 2 vendors · 3 advisories

CVE-2026-34500

CVE-2026-34500: 3 tracked advisory records across Apache, Red Hat. Compare vendor sources and published fix guidance.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Vendor advisory comparison

Apache

2 advisories
  • Advisory severityCritical9.8

    Critical [CVE-2026-34500 +1] CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat

    CVE-2026-86248Source published Source updated

    This bulletin covers 2 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

    CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from 10.1.22 through 10.1.59, from 9.0.92 through 9.0.121. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.

    Affected products in this advisory
    • Apache Tomcat
    Source-reported affected versions
    • 11.0.0-M14 through 11.0.25
    • 10.1.22 through 10.1.59
    • 9.0.92 through 9.0.121.
    • through 9.0.121
    Source-reported fixed versions
    • 11.0.26
    • 10.1.60
    • 9.0.122
    Mitigation guidance
    • Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
    Full advisory and evidenceOpen source bulletin
  • Advisory severityMedium6.5

    Medium [CVE-2026-34500] Apache Tomcat: CLIENT_CERT authentication does not fail as expected for some scenarios

    CVE-2026-34500Source published Source updated

    CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fixes the issue.

    Affected products in this advisory
    • Apache Tomcat
    • Tomcat
    Source-reported affected versions
    • 11.0.0-M14 through 11.0.20
    • 10.1.22 through 10.1.53
    • 9.0.92 through 9.0.116.
    • through 9.0.116
    Source-reported fixed versions
    • 11.0.21
    • 10.1.54
    • 9.0.117
    Mitigation guidance
    No mitigation guidance extracted; consult the source.
    Full advisory and evidenceOpen source bulletin

Red Hat

1 advisory
  • Advisory severityMedium5.9

    Medium [CVE-2026-34500] Authentication bypass via client certificate misconfiguration

    CVE-2026-34500Source published

    Authentication bypass via client certificate misconfiguration. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-303. Affected package(s): tomcat, jws6-tomcat. Resolved in Red Hat advisory RHSA-2026:20405 — update the affected packages (`sudo dnf update`).

    Related products — impact not confirmed
    • Red Hat Enterprise Linux 1
    • Red Hat Enterprise Linux 8
    • Red Hat Enterprise Linux 9
    • jws6-tomcat
    Source-reported affected versions
    • tomcat
    • jws6-tomcat-0:10.1.49-13.redhat_00011.1.el10jws
    • jws6-tomcat-0:10.1.49-13.redhat_00011.1.el8jws
    • jws6-tomcat-0:10.1.49-13.redhat_00011.1.el9jws
    Source-reported fixed versions
    • RHSA-2026:20405
    Mitigation guidance
    • Update the affected package(s) to the fixed version shipped in RHSA-2026:20405 (`sudo dnf update` / `yum update`).
    Full advisory and evidenceOpen source bulletin

Android app · Google Play

Turn CVE research into alerts on your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features