CVE-2026-74048

Awaiting Analysis Awaiting Analysis - Queue

Failing Open in Apache Tomcat with OpenSSL FIPS Mode

Publication date: 2026-10-20

Last updated on: 2026-10-29

Assigner: Apache Software Foundation

Description

Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs and error but continues to use JSSE in non-FIPS mode with the provided configuration. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.26, from 10.1.22 through 10.1.60, from 9.0.92 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-29

Generated

2026-11-09

AI Q&A

2026-10-20

EPSS Evaluated

2026-11-08

NVD

CVE-2026-74048

EUVD

EUVD-2026-105004

Affected Vendors & Products

Vendor	Product	Version / Range
Apache Software Foundation	Apache Tomcat	11.0.0-M14
Apache Software Foundation	Apache Tomcat	10.1.22
Apache Software Foundation	Apache Tomcat	9.0.92

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-636	When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.

Attack-Flow Graph

Executive Summary

This is a Failing Open vulnerability in Apache Tomcat where the OpenSSLLifecycleListener fails to enforce FIPS mode properly. If FIPS activation fails, Tomcat logs an error but continues running in non-FIPS mode using the original configuration, potentially exposing sensitive data.

Detection Guidance

Check Tomcat logs for errors related to OpenSSL FIPS mode activation failure. Look for messages indicating FIPS mode could not be enabled but Tomcat continues in non-FIPS mode. Verify Tomcat version against affected ranges (11.0.0-M14 to 11.0.26, 10.1.22 to 10.1.60, 9.0.92 to 9.0.122).

Commands: grep -i 'fips' /path/to/tomcat/logs/catalina.out; /path/to/tomcat/bin/version.sh | grep 'Server number'

Impact Analysis

If you rely on FIPS compliance for secure communications, this flaw could allow encrypted traffic to bypass FIPS restrictions, weakening security. Attackers might exploit this to intercept or manipulate data under the false assumption of FIPS protection.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, or other regulations requiring FIPS-validated cryptography. Organizations using affected Tomcat versions may fail audits or face penalties for failing to meet mandated security standards.

Mitigation Strategies

Upgrade Apache Tomcat to a fixed version: 11.0.27, 10.1.61, or 9.0.123. After upgrade, verify FIPS mode activation succeeds by checking logs for successful FIPS initialization.

Hi! I’m here to help you understand CVE-2026-74048. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...