Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.apache.tomcat/tomcat@9.0.92
purl pkg:maven/org.apache.tomcat/tomcat@9.0.92
Tags Ghost
Next non-vulnerable version None.
Latest non-vulnerable version None.
Risk score
Vulnerabilities affecting this package (6)
Advisory Summary Fixed in package version
CVE-2026-34500
Aliases:
GHSA-24j9-x2wg-9qv6
Apache Tomcat: CLIENT_CERT authentication does not fail as expected CLIENT_CERT authentication does not fail as expected for some scenarios when …
11.0.21
Vulnerable
9.0.117
Vulnerable
10.1.54
Vulnerable
11.0.21
Vulnerable
9.0.117
Vulnerable
10.1.54
Vulnerable
CVE-2026-86248

Moderate: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled
9.0.122
Vulnerable
CVE-2026-34500

Moderate: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled
9.0.117
Vulnerable
CVE-2024-52317

Important: Request and/or response mix-up
9.0.96
Vulnerable
CVE-2026-88041

Low: HTTP/2 trailer header cross-contamination
9.0.123
Vulnerable
CVE-2026-74048

Low: OpenSSL-FFM FIPS failure does not prevent start-up
9.0.123
Vulnerable
This package is not known to fix any advisories.