UpHeron
All vulnerabilities

Servers and applications

CVE-2026-24734

Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification or freshness checks on the OCSP response which could allow certificate revocation to be bypassed. This issue affects Apache Tomcat Native:  from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11;…

Severity
High 7.5
Published
17 Feb 2026
Last changed
15 Jul 2026
Added to UpHeron
21 Oct 2026
Fixed in
9.0.115, 10.1.52, 11.0.18
Sources
NVD

Affected software

SoftwareAffected versions
Apache TomcatServers and applications · cpe:a:apache:tomcat
  • From 11.0.1 before 11.0.18
  • Version 11.0.0-milestone26
  • Version 11.0.0-milestone25
  • Version 11.0.0-milestone24
All 49 release lines
  • From 9.0.83 before 9.0.115
  • Version 10.1.0-milestone1
  • Version 10.1.0-milestone2
  • Version 10.1.0-milestone3
  • Version 10.1.0-milestone4
  • Version 10.1.0-milestone5
  • Version 10.1.0-milestone6
  • Version 10.1.0-milestone7
  • Version 10.1.0-milestone8
  • Version 10.1.0-milestone9
  • Version 10.1.0-milestone10
  • Version 10.1.0-milestone11
  • Version 10.1.0-milestone12
  • Version 10.1.0-milestone13
  • Version 10.1.0-milestone14
  • Version 10.1.0-milestone15
  • Version 10.1.0-milestone16
  • Version 10.1.0-milestone17
  • Version 10.1.0-milestone18
  • Version 10.1.0-milestone19
  • Version 10.1.0-milestone20
  • From 10.1.1 before 10.1.52
  • Version 11.0.0-milestone1
  • Version 11.0.0-milestone2
  • Version 11.0.0-milestone3
  • Version 11.0.0-milestone4
  • Version 11.0.0-milestone5
  • Version 11.0.0-milestone6
  • Version 11.0.0-milestone7
  • Version 11.0.0-milestone8
  • Version 11.0.0-milestone9
  • Version 11.0.0-milestone10
  • Version 11.0.0-milestone11
  • Version 11.0.0-milestone12
  • Version 11.0.0-milestone13
  • Version 11.0.0-milestone14
  • Version 11.0.0-milestone15
  • Version 11.0.0-milestone16
  • Version 11.0.0-milestone17
  • Version 11.0.0-milestone18
  • Version 11.0.0-milestone19
  • Version 11.0.0-milestone20
  • Version 11.0.0-milestone21
  • Version 11.0.0-milestone22
  • Version 11.0.0-milestone23
  • Version 11.0.0-milestone24
  • Version 11.0.0-milestone25
  • Version 11.0.0-milestone26
  • From 11.0.1 before 11.0.18

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-24734
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-24734