CVE-2026-29145

Public PoC / Exploit

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13. Users are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses (CWE)

CWE-287

Affected Products (20)

apache · tomcat (up to 9.0.116)vulnerable

apache · tomcat (up to 10.1.53)vulnerable

apache · tomcat (up to 11.0.20)vulnerable

apache · tomcatvulnerable

apache · tomcat_native (up to 1.3.7)vulnerable

apache · tomcat_native (up to 2.0.14)vulnerable

References (2)

https://lists.apache.org/thread/yz5fxmhd2j43wgqykssdo7kltws57jfz

Mailing ListVendor Advisory

http://www.openwall.com/lists/oss-security/2026/04/09/23

Mailing ListThird Party Advisory