CVE-2026-29145: Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled | LiveThreat CVE Feed — Verisq

Login Request a demo

Critical severity · published Apr 9, 2026

CVE-2026-29145

Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled

9.1

CVSS

0.7%

EPSS

No

On KEV

Description

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13. Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.7% · higher than 54% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

TO

Tomcat · Apache

11.0.0-M1 through 11.0.18; 10.1.0-M7 through 10.1.52; 9.0.83 through 9.0.115 · source: vendor, NVD

AT

Apache Tomcat Native · Apache Software Foundation

1.1.23 through 1.1.34; 1.2.0 through 1.2.39; 1.3.0 through 1.3.6; 2.0.0 through 2.0.13 · source: vendor

TN

Tomcat Native · Apache

1.1.23 before 1.3.7; 2.0.0 before 2.0.14 · source: NVD

Affected product

TO

Tomcat

Apache

All Tomcat CVEs

References

https://nvd.nist.gov/vuln/detail/CVE-2026-29145

https://www.cve.org/CVERecord?id=CVE-2026-29145

https://lists.apache.org/thread/yz5fxmhd2j43wgqykssdo7kltws57jfz

http://www.openwall.com/lists/oss-security/2026/04/09/23

More from Tomcat

9.8

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

9.8

Apache Tomcat Improper Privilege Management Vulnerability

9.8

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if…

8.1

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g

8.1

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g