Open-source package vulnerability · Maven

CVE-2026-29145: Apache Tomcat: CLIENT_CERT authentication does not fail as expected

criticalCVSS 3.1 9.1GHSA-95jq-rwvf-vjx4

CLIENTCERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13.

Published Apr 9, 2026 · Updated May 20, 2026

Affected packages

org.apache.tomcat:tomcat

Ecosystem: Maven
Affected: >= 9.0.83, < 9.0.116
Fixed in: 9.0.116
Check: mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat

org.apache.tomcat:tomcat

Ecosystem: Maven
Affected: >= 10.1.0-M7, < 10.1.53
Fixed in: 10.1.53
Check: mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat

org.apache.tomcat:tomcat

Ecosystem: Maven
Affected: >= 11.0.0-M1, < 11.0.20
Fixed in: 11.0.20
Check: mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat

org.apache.tomcat:tomcat-coyote-ffm

Ecosystem: Maven
Affected: >= 9.0.83, < 9.0.116
Fixed in: 9.0.116
Check: mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat-coyote-ffm

org.apache.tomcat:tomcat-coyote-ffm

Ecosystem: Maven
Affected: >= 10.1.0-M7, < 10.1.53
Fixed in: 10.1.53
Check: mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat-coyote-ffm

org.apache.tomcat:tomcat-coyote-ffm

Ecosystem: Maven
Affected: >= 11.0.0-M1, < 11.0.20
Fixed in: 11.0.20
Check: mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat-coyote-ffm

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13.

Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.

Credited to aruneko.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Maven vulnerabilities

All Maven entries