Vulnpedia
← Search CVEs

CVE-2026-74048

N/A

Published 2026-10-20 · Last modified 2026-10-20

Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.26, from 10.1.22 through 10.1.60, from 9.0.92 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.

NO EXPLOITATION SIGNALS

No known exploitation, public exploit, or elevated probability at this time. Track for changes.

Exploitation likelihood

0.2%chance of exploitation in 30 days · 14th percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

—CVSS · not scored

  • No impact metrics

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Apache Software Foundation

Products Apache Tomcat

Weakness (CWE)

  • CWE-636: Not Failing Securely ('Failing Open')

CVSS vector

Not yet scored.

References and research data (JSON)

Vendor product assessments

Showing 32 of 153 vendor product statements; 121 omitted. Read the full vendor advisory.

  • tomcat10-0:10.1.61-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure automated startup monitoring or health-check scripts to verify Tomcat logs for OpenSSLLifecycleListener FIPS activation errors and terminate the process immediately upon failure, or ensure the underlying host operating system and JVM enforce FIPS mode globally.
    Red Hat · CVE-2026-74048 · Updated 2026-10-21T19:44:04+00:00
  • tomcat10-admin-webapps-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure automated startup monitoring or health-check scripts to verify Tomcat logs for OpenSSLLifecycleListener FIPS activation errors and terminate the process immediately upon failure, or ensure the underlying host operating system and JVM enforce FIPS mode globally.
    Red Hat · CVE-2026-74048 · Updated 2026-10-21T19:44:04+00:00
  • tomcat10-docs-webapp-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure automated startup monitoring or health-check scripts to verify Tomcat logs for OpenSSLLifecycleListener FIPS activation errors and terminate the process immediately upon failure, or ensure the underlying host operating system and JVM enforce FIPS mode globally.
    Red Hat · CVE-2026-74048 · Updated 2026-10-21T19:44:04+00:00
  • tomcat10-jsp-3.1-api-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure automated startup monitoring or health-check scripts to verify Tomcat logs for OpenSSLLifecycleListener FIPS activation errors and terminate the process immediately upon failure, or ensure the underlying host operating system and JVM enforce FIPS mode globally.
    Red Hat · CVE-2026-74048 · Updated 2026-10-21T19:44:04+00:00
  • tomcat10-servlet-6.0-api-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure automated startup monitoring or health-check scripts to verify Tomcat logs for OpenSSLLifecycleListener FIPS activation errors and terminate the process immediately upon failure, or ensure the underlying host operating system and JVM enforce FIPS mode globally.
    Red Hat · CVE-2026-74048 · Updated 2026-10-21T19:44:04+00:00
  • tomcat10-webapps-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure automated startup monitoring or health-check scripts to verify Tomcat logs for OpenSSLLifecycleListener FIPS activation errors and terminate the process immediately upon failure, or ensure the underlying host operating system and JVM enforce FIPS mode globally.
    Red Hat · CVE-2026-74048 · Updated 2026-10-21T19:44:04+00:00
  • tomcat11-admin-webapps-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure automated startup monitoring or health-check scripts to verify Tomcat logs for OpenSSLLifecycleListener FIPS activation errors and terminate the process immediately upon failure, or ensure the underlying host operating system and JVM enforce FIPS mode globally.
    Red Hat · CVE-2026-74048 · Updated 2026-10-21T19:44:04+00:00
  • tomcat11-docs-webapp-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure automated startup monitoring or health-check scripts to verify Tomcat logs for OpenSSLLifecycleListener FIPS activation errors and terminate the process immediately upon failure, or ensure the underlying host operating system and JVM enforce FIPS mode globally.
    Red Hat · CVE-2026-74048 · Updated 2026-10-21T19:44:04+00:00
  • tomcat11-jsp-4.0-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure automated startup monitoring or health-check scripts to verify Tomcat logs for OpenSSLLifecycleListener FIPS activation errors and terminate the process immediately upon failure, or ensure the underlying host operating system and JVM enforce FIPS mode globally.
    Red Hat · CVE-2026-74048 · Updated 2026-10-21T19:44:04+00:00
  • tomcat11-servlet-6.1-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure automated startup monitoring or health-check scripts to verify Tomcat logs for OpenSSLLifecycleListener FIPS activation errors and terminate the process immediately upon failure, or ensure the underlying host operating system and JVM enforce FIPS mode globally.
    Red Hat · CVE-2026-74048 · Updated 2026-10-21T19:44:04+00:00
  • tomcat11-webapps-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure automated startup monitoring or health-check scripts to verify Tomcat logs for OpenSSLLifecycleListener FIPS activation errors and terminate the process immediately upon failure, or ensure the underlying host operating system and JVM enforce FIPS mode globally.
    Red Hat · CVE-2026-74048 · Updated 2026-10-21T19:44:04+00:00
  • tomcat as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat

    • workaround: Configure automated startup monitoring or health-check scripts to verify Tomcat logs for OpenSSLLifecycleListener FIPS activation errors and terminate the process immediately upon failure, or ensure the underlying host operating system and JVM enforce FIPS mode globally.
    • none available: Fix deferred
    Red Hat · CVE-2026-74048 · Updated 2026-10-21T19:44:04+00:00
  • tomcat-lib as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat-lib

    • workaround: Configure automated startup monitoring or health-check scripts to verify Tomcat logs for OpenSSLLifecycleListener FIPS activation errors and terminate the process immediately upon failure, or ensure the underlying host operating system and JVM enforce FIPS mode globally.
    • none available: Fix deferred
    Red Hat · CVE-2026-74048 · Updated 2026-10-21T19:44:04+00:00
  • tomcat9 as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat9

    • workaround: Configure automated startup monitoring or health-check scripts to verify Tomcat logs for OpenSSLLifecycleListener FIPS activation errors and terminate the process immediately upon failure, or ensure the underlying host operating system and JVM enforce FIPS mode globally.
    • none available: Fix deferred
    Red Hat · CVE-2026-74048 · Updated 2026-10-21T19:44:04+00:00
  • tomcat9-lib as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat9-lib

    • workaround: Configure automated startup monitoring or health-check scripts to verify Tomcat logs for OpenSSLLifecycleListener FIPS activation errors and terminate the process immediately upon failure, or ensure the underlying host operating system and JVM enforce FIPS mode globally.
    • none available: Fix deferred
    Red Hat · CVE-2026-74048 · Updated 2026-10-21T19:44:04+00:00
  • tomcat-admin-webapps as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat-admin-webapps

    • workaround: Configure automated startup monitoring or health-check scripts to verify Tomcat logs for OpenSSLLifecycleListener FIPS activation errors and terminate the process immediately upon failure, or ensure the underlying host operating system and JVM enforce FIPS mode globally.
    • none available: Fix deferred
    Red Hat · CVE-2026-74048 · Updated 2026-10-21T19:44:04+00:00
  • tomcat-servlet-4.0-api as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat-servlet-4.0-api

    • workaround: Configure automated startup monitoring or health-check scripts to verify Tomcat logs for OpenSSLLifecycleListener FIPS activation errors and terminate the process immediately upon failure, or ensure the underlying host operating system and JVM enforce FIPS mode globally.
    • none available: Fix deferred
    Red Hat · CVE-2026-74048 · Updated 2026-10-21T19:44:04+00:00
  • tomcat-admin-webapps as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat-admin-webapps

    • workaround: Configure automated startup monitoring or health-check scripts to verify Tomcat logs for OpenSSLLifecycleListener FIPS activation errors and terminate the process immediately upon failure, or ensure the underlying host operating system and JVM enforce FIPS mode globally.
    • none available: Fix deferred
    Red Hat · CVE-2026-74048 · Updated 2026-10-21T19:44:04+00:00
  • tomcat-servlet-4.0-api as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat-servlet-4.0-api

    • workaround: Configure automated startup monitoring or health-check scripts to verify Tomcat logs for OpenSSLLifecycleListener FIPS activation errors and terminate the process immediately upon failure, or ensure the underlying host operating system and JVM enforce FIPS mode globally.
    • none available: Fix deferred
    Red Hat · CVE-2026-74048 · Updated 2026-10-21T19:44:04+00:00
  • jws6-tomcat-docs-webapp as a component of Red Hat JBoss Web Server 6 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/jws6-tomcat-docs-webapp

    • workaround: Configure automated startup monitoring or health-check scripts to verify Tomcat logs for OpenSSLLifecycleListener FIPS activation errors and terminate the process immediately upon failure, or ensure the underlying host operating system and JVM enforce FIPS mode globally.
    • none available: Fix deferred
    Red Hat · CVE-2026-74048 · Updated 2026-10-21T19:44:04+00:00
  • jws6-tomcat-lib as a component of Red Hat JBoss Web Server 6 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/jws6-tomcat-lib

    • workaround: Configure automated startup monitoring or health-check scripts to verify Tomcat logs for OpenSSLLifecycleListener FIPS activation errors and terminate the process immediately upon failure, or ensure the underlying host operating system and JVM enforce FIPS mode globally.
    • none available: Fix deferred
    Red Hat · CVE-2026-74048 · Updated 2026-10-21T19:44:04+00:00
  • jws7-tomcat.src as a component of Red Hat JBoss Web Server 7 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/jws7-tomcat?arch=src

    • workaround: Configure automated startup monitoring or health-check scripts to verify Tomcat logs for OpenSSLLifecycleListener FIPS activation errors and terminate the process immediately upon failure, or ensure the underlying host operating system and JVM enforce FIPS mode globally.
    • none available: Fix deferred
    Red Hat · CVE-2026-74048 · Updated 2026-10-21T19:44:04+00:00
  • tomcat6 as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/tomcat6

    Red Hat · CVE-2026-74048 · Updated 2026-10-21T19:44:04+00:00
  • tomcat6-jsp-2.1-api as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/tomcat6-jsp-2.1-api

    Red Hat · CVE-2026-74048 · Updated 2026-10-21T19:44:04+00:00
  • tomcat6-webapps as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/tomcat6-webapps

    Red Hat · CVE-2026-74048 · Updated 2026-10-21T19:44:04+00:00
  • tomcat-el-2.2-api as a component of Red Hat Enterprise Linux 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/tomcat-el-2.2-api

    Red Hat · CVE-2026-74048 · Updated 2026-10-21T19:44:04+00:00
  • tomcat-servlet-3.0-api as a component of Red Hat Enterprise Linux 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/tomcat-servlet-3.0-api

    Red Hat · CVE-2026-74048 · Updated 2026-10-21T19:44:04+00:00
  • pki-servlet-engine.src (pki-deps:10.6) as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/pki-servlet-engine?arch=src&rpmmod=pki-deps:10.6

    Red Hat · CVE-2026-74048 · Updated 2026-10-21T19:44:04+00:00
  • hi/tomcat as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/tomcat?repository_url=registry.redhat.io/hi/tomcat

    Red Hat · CVE-2026-74048 · Updated 2026-10-21T19:44:04+00:00
  • jws5-tomcat-java-jdk11 as a component of Red Hat JBoss Web Server 5 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/jws5-tomcat-java-jdk11

    Red Hat · CVE-2026-74048 · Updated 2026-10-21T19:44:04+00:00
  • jws5-tomcat-jsvc as a component of Red Hat JBoss Web Server 5 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/jws5-tomcat-jsvc

    Red Hat · CVE-2026-74048 · Updated 2026-10-21T19:44:04+00:00
  • jws5-tomcat.src as a component of Red Hat JBoss Web Server 5 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/jws5-tomcat?arch=src

    Red Hat · CVE-2026-74048 · Updated 2026-10-21T19:44:04+00:00

References

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS