UpHeron
All vulnerabilities

Servers and applications

CVE-2026-29145

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0…

Severity
Critical 9.1
Published
9 Apr 2026
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
9.0.116, 10.1.53, 11.0.20
Sources
NVD

Affected software

SoftwareAffected versions
Apache TomcatServers and applications · cpe:a:apache:tomcat
  • From 11.0.0 before 11.0.20
  • From 10.1.1 before 10.1.53
  • Version 10.1.0-milestone20
  • Version 10.1.0-milestone19
All 18 release lines
  • From 9.0.83 before 9.0.116
  • Version 10.1.0
  • Version 10.1.0-milestone7
  • Version 10.1.0-milestone8
  • Version 10.1.0-milestone9
  • Version 10.1.0-milestone10
  • Version 10.1.0-milestone11
  • Version 10.1.0-milestone12
  • Version 10.1.0-milestone13
  • Version 10.1.0-milestone14
  • Version 10.1.0-milestone15
  • Version 10.1.0-milestone16
  • Version 10.1.0-milestone17
  • Version 10.1.0-milestone18
  • Version 10.1.0-milestone19
  • Version 10.1.0-milestone20
  • From 10.1.1 before 10.1.53
  • From 11.0.0 before 11.0.20

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-29145
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-29145