Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.apache.tomcat/tomcat@10.1.22
purl pkg:maven/org.apache.tomcat/tomcat@10.1.22
Tags Ghost
Next non-vulnerable version None.
Latest non-vulnerable version None.
Risk score
Vulnerabilities affecting this package (4)
Advisory Summary Fixed in package version
CVE-2026-34500
Aliases:
GHSA-24j9-x2wg-9qv6
Apache Tomcat: CLIENT_CERT authentication does not fail as expected CLIENT_CERT authentication does not fail as expected for some scenarios when …
11.0.21
Vulnerable
9.0.117
Vulnerable
10.1.54
Vulnerable
11.0.21
Vulnerable
9.0.117
Vulnerable
10.1.54
Vulnerable
CVE-2026-86248

Moderate: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled
10.1.60
Vulnerable
CVE-2026-34500

Moderate: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled
10.1.54
Vulnerable
CVE-2026-74048

Low: OpenSSL-FFM FIPS failure does not prevent start-up
10.1.61
Vulnerable
This package is not known to fix any advisories.