CVE-2026-74048

—Unscored

Published 20 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

—Unscored

Attack vector: —
Complexity: —
Privileges needed: —
User interaction: —
Impact: —
Weakness: CWE-636

Impact

Tomcat silently falls back to standard JSSE when FIPS mode initialization fails, leaving network traffic encrypted with non-compliant cryptography. This affects compliance and security boundaries for any deployment requiring strict FIPS enforcement.

Root cause

The OpenSSLLifecycleListener fails open by logging an error and continuing in non-FIPS mode instead of terminating when FIPS activation fails.

Affected systems

Apache Tomcat 11.0.0-M14 through 11.0.26, 10.1.22 through 10.1.60, and 9.0.92 through 9.0.122

Fix & remediation

Upgrade to Tomcat 11.0.27, 10.1.61, or 9.0.123. If patching immediately is not possible, inspect your logs to verify FIPS activation succeeds and ensure the underlying OpenSSL FIPS provider is working without error.

shell

$ catalina.sh version

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.26, from 10.1.22 through 10.1.60, from 9.0.92 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-74048