CVE-2026-74048
published 2026-10-20CVE-2026-74048: Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails…
PriorityP433low3.7
EPSS
0.23%
13.6th percentile
Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration.
This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.26, from 10.1.22 through 10.1.60, from 9.0.92 through 9.0.122.
Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache_software_foundation | apache_tomcat | 10.1.22 – 10.1.60 | — |
| apache_software_foundation | apache_tomcat | 11.0.0-M14 – 11.0.26 | — |
| apache_software_foundation | apache_tomcat | 9.0.92 – 9.0.122 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat.
ghsa_unreviewed·2026-10-20
CVE-2026-74048 CWE-636 Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat.
Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration.
This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.26, from 10.1.22 through 10.1.60, from 9.0.92 through 9.0.122.
Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.
Red Hat
tomcat: Tomcat: Cryptographic policy bypass via FIPS activation failure
vendor_redhat·2026-10-20·CVSS 3.7
CVE-2026-74048 [LOW] CWE-455 tomcat: Tomcat: Cryptographic policy bypass via FIPS activation failure
tomcat: Tomcat: Cryptographic policy bypass via FIPS activation failure
A flaw was found in Apache Tomcat. When the server is configured to enforce FIPS (Federal Information Processing Standards) mode, a failure during FIPS activation causes Tomcat to log an error and continue running with standard non-FIPS cryptographic providers instead of terminating securely. This allows the application to process secure connections using unapproved or weaker cryptography, which may violate compliance mandates and weaken expected cryptographic protections.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-74048 tomcat: Tomcat: Cryptographic policy bypass via FIPS activation failure [fedora-rawhide]
bugzilla·2026-10-21
CVE-2026-74048 [LOW] CVE-2026-74048 tomcat: Tomcat: Cryptographic policy bypass via FIPS activation failure [fedora-rawhide]
CVE-2026-74048 tomcat: Tomcat: Cryptographic policy bypass via FIPS activation failure [fedora-rawhide]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration.
This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.26, from 10.1.22 through 10.1.60, from 9.0.92 through 9.0.122.
Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix
Bugzilla
CVE-2026-74048 tomcat: Tomcat: Cryptographic policy bypass via FIPS activation failure [fedora-44]
bugzilla·2026-10-21
CVE-2026-74048 [LOW] CVE-2026-74048 tomcat: Tomcat: Cryptographic policy bypass via FIPS activation failure [fedora-44]
CVE-2026-74048 tomcat: Tomcat: Cryptographic policy bypass via FIPS activation failure [fedora-44]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration.
This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.26, from 10.1.22 through 10.1.60, from 9.0.92 through 9.0.122.
Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the
Bugzilla
CVE-2026-74048 tomcat: Tomcat: Cryptographic policy bypass via FIPS activation failure [fedora-43]
bugzilla·2026-10-21
CVE-2026-74048 [LOW] CVE-2026-74048 tomcat: Tomcat: Cryptographic policy bypass via FIPS activation failure [fedora-43]
CVE-2026-74048 tomcat: Tomcat: Cryptographic policy bypass via FIPS activation failure [fedora-43]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration.
This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.26, from 10.1.22 through 10.1.60, from 9.0.92 through 9.0.122.
Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the
Bugzilla
CVE-2026-74048 tomcat: Tomcat: Cryptographic policy bypass via FIPS activation failure
bugzilla·2026-10-20
CVE-2026-74048 [LOW] CVE-2026-74048 tomcat: Tomcat: Cryptographic policy bypass via FIPS activation failure
CVE-2026-74048 tomcat: Tomcat: Cryptographic policy bypass via FIPS activation failure
Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration.
This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.26, from 10.1.22 through 10.1.60, from 9.0.92 through 9.0.122.
Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.
2026-10-20
Published