CVE-2026-24734

apache tomcat, apache tomcat native

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2026-24734

Katalog CVE

CVSS 7.5 · High EPSS 0,52%

Kerentanan Improper Input Validation pada apache tomcat, apache tomcat native. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification or freshness checks on the OCSP response which could allow certificate revocation to be bypassed. This issue affects Apache Tomcat Native:  from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11; Apache Tomcat: from 11.0.0-M1 through 11.0.17, from 10.1.0-M7 through 10.1.51, from 9.0.83 through 9.0.114. The following versions were EOL at the time the CVE was created but are known to be affected: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39. Older EOL versions are not affected. Apache Tomcat Native users are recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which fix the issue. Apache Tomcat users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115 or later which fix the issue.

Rincian

Terbit di NVD
17 Februari 2026
Terakhir diubah
15 Juli 2026
Status NVD
Modified
CVSS 3.1
7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-20: Improper Input Validation
CWE-295: Improper Certificate Validation
EPSS (30 hari)
0,52% peluang dieksploitasi; lebih tinggi dari 42,3% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
apache tomcat Versi 9.0.83 hingga sebelum 9.0.115
apache tomcat Versi 10.1.1 hingga sebelum 10.1.52
apache tomcat Versi 11.0.1 hingga sebelum 11.0.18
apache tomcat Versi 10.1.0 milestone1
apache tomcat Versi 10.1.0 milestone10
apache tomcat Versi 10.1.0 milestone11
apache tomcat Versi 10.1.0 milestone12
apache tomcat Versi 10.1.0 milestone13
apache tomcat Versi 10.1.0 milestone14
apache tomcat Versi 10.1.0 milestone15
apache tomcat Versi 10.1.0 milestone16
apache tomcat Versi 10.1.0 milestone17
apache tomcat Versi 10.1.0 milestone18
apache tomcat Versi 10.1.0 milestone19
apache tomcat Versi 10.1.0 milestone2
apache tomcat Versi 10.1.0 milestone20
apache tomcat Versi 10.1.0 milestone3
apache tomcat Versi 10.1.0 milestone4
apache tomcat Versi 10.1.0 milestone5
apache tomcat Versi 10.1.0 milestone6
apache tomcat Versi 10.1.0 milestone7
apache tomcat Versi 10.1.0 milestone8
apache tomcat Versi 10.1.0 milestone9
apache tomcat Versi 11.0.0 milestone1
apache tomcat Versi 11.0.0 milestone10
apache tomcat Versi 11.0.0 milestone11
apache tomcat Versi 11.0.0 milestone12
apache tomcat Versi 11.0.0 milestone13
apache tomcat Versi 11.0.0 milestone14
apache tomcat Versi 11.0.0 milestone15
apache tomcat Versi 11.0.0 milestone16
apache tomcat Versi 11.0.0 milestone17
apache tomcat Versi 11.0.0 milestone18
apache tomcat Versi 11.0.0 milestone19
apache tomcat Versi 11.0.0 milestone2
apache tomcat Versi 11.0.0 milestone20
apache tomcat Versi 11.0.0 milestone21
apache tomcat Versi 11.0.0 milestone22
apache tomcat Versi 11.0.0 milestone23
apache tomcat Versi 11.0.0 milestone24
apache tomcat Versi 11.0.0 milestone25
apache tomcat Versi 11.0.0 milestone26
apache tomcat Versi 11.0.0 milestone3
apache tomcat Versi 11.0.0 milestone4
apache tomcat Versi 11.0.0 milestone5
apache tomcat Versi 11.0.0 milestone6
apache tomcat Versi 11.0.0 milestone7
apache tomcat Versi 11.0.0 milestone8
apache tomcat Versi 11.0.0 milestone9
apache tomcat native Versi 1.3.0 hingga sebelum 1.3.5
apache tomcat native Versi 2.0.0 hingga sebelum 2.0.12

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.