Vulnerability Description
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13. Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Tomcat | >= 9.0.83, < 9.0.116 |
| Apache | Tomcat Native | >= 1.1.23, < 1.3.7 |
Related Weaknesses (CWE)
References
- https://lists.apache.org/thread/yz5fxmhd2j43wgqykssdo7kltws57jfzMailing ListVendor Advisory
- http://www.openwall.com/lists/oss-security/2026/04/09/23Mailing ListThird Party Advisory
FAQ
What is CVE-2026-29145?
CVE-2026-29145 is a vulnerability with a CVSS score of 9.1 (CRITICAL). CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native. This issue affects Apache Tomcat: from 11.0.0-...
How severe is CVE-2026-29145?
CVE-2026-29145 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-29145?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Tomcat, Apache Tomcat Native.