Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps Apache Software Foundation/Apache Tomcat (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for Apache Software Foundation/Apache Tomcat.
2. 2Review the reported fix. Monitor this advisory for an available fix and review any installs of the affected package.

Evidence timeline and material changes

1. Published upstream

   Sep 23, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Sep 23, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Sep 23, 2026

Sources and claim methodology

• Source referencelists.apache.org

Related CVEs

• Apache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystoreSame apache software foundation/apache tomcat package
• Apache Tomcat: Cross-context authentication mix-up with Jakarta Authentication configuredSame apache software foundation/apache tomcat package
• Apache Tomcat: Bypass of security constraints for WebSocket endpointsSame apache software foundation/apache tomcat package
• Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requestsSame apache software foundation/apache tomcat package
• Apache Tomcat: Stale HPACK emitter injects trailers into recycled pooled RequestSame apache software foundation/apache tomcat package
• Apache Tomcat: DoS via busy wait during WebSocket closeSame apache software foundation/apache tomcat package