CVE-2026-24734
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Description
A flaw was found in Apache Tomcat. When an Online Certificate Status Protocol (OCSP) responder is used, the Tomcat Native component, and Tomcat's FFM port of the Tomcat Native code, does not properly verify or check the freshness of the OCSP response. This improper input validation vulnerability could allow an attacker to bypass certificate revocation checks, potentially leading to the acceptance of revoked certificates.
Metrics
Weakness classes (CWE)
CWE-20Class
Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
cwe.mitre.org →
Affected products
Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.
bitnami
tomcat10.0.0
bitnami
tomcat10.1.0
bitnami
tomcat11.0.0
bitnami
tomcat8.5.0
bitnami
tomcat9.0.83
References & sources
- https://nvd.nist.gov/vuln/detail/CVE-2025-61795advisory
- https://github.com/apache/tomcat/commit/1cdf5f730ede75a0759492f179ac21ca4ff68e06web
- https://github.com/apache/tomcat/commit/af6e9181620304c0d818121c29c074e1330610d0web
- https://github.com/apache/tomcat/commit/afa422bd7ca1eef0f507259c682fd876494d9c3bweb
- https://cert-portal.siemens.com/productcert/html/ssa-032379.htmlweb
- https://github.com/apache/tomcatpackage
- https://lists.apache.org/thread/wm9mx8brmx9g4zpywm06ryrtvd3160ppweb
- https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.47web
- https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.12web
- https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.110web
- http://www.openwall.com/lists/oss-security/2025/10/27/6web
- https://nvd.nist.gov/vuln/detail/CVE-2025-55668advisory
- https://github.com/apache/tomcat/commit/8621e4c6ba2c916a41eb34cb0f781171ead33fb6web
- https://github.com/apache/tomcat/commit/90306d971bb8b8393336d893644124fb2ca11d21web
- https://github.com/apache/tomcat/commit/9c3673ba04009377cb0c81ccb6cf5078aec1aa95web
- https://lists.apache.org/thread/v6bknr96rl7l1qxkl1c03v0qdvbbqs47web
- https://tomcat.apache.org/security-10.htmlweb
- https://tomcat.apache.org/security-11.htmlweb
- https://tomcat.apache.org/security-9.htmlweb
- http://www.openwall.com/lists/oss-security/2025/08/13/3web
Linked CVEs
- CVE-2026-24733
A flaw was found in Tomcat.
— - CVE-2025-66614
A certificate validation flaw has been found in Apache Tomcat.
— - CVE-2025-61795
A denial of service flaw has been discovered in Apache Tomcat.
mediumCVSSv3 5.3 - CVE-2025-55754
An improper input neutralization flaw has been discovered in Apache Tomcat.
criticalCVSSv3 9.6 - CVE-2025-55752
A directory traversal vulnerability in Apache Tomcat caused by improper URL normalization during request rewriting.
highCVSSv3 7.5 - CVE-2025-55668
A session fixation vulnerability has been identified in Apache Tomcat, affecting its rewrite functionality.
mediumCVSSv3 6.5