UnratedFix available

DEBIAN-CVE-2026-24734

Type: advisorySource: OSV1 source record

Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete verification or freshness checks on the OCSP response which could allow certificate revocation to be bypassed. This issue affects Apache Tomcat Native: from 1.3.0 through 1.3.4, from 2.0.0 through 2.0.11; Apache Tomcat: from 11.0.0-M1 through 11.0.17, from 10.1.0-M7 through 10.1.51, from 9.0.83 through 9.0.114. The following versions were EOL at the time the CVE was created but are known to be affected: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39. Older EOL versions are not affected. Apache Tomcat Native users are recommended to upgrade to versions 1.3.5 or later or 2.0.12 or later, which fix the issue. Apache Tomcat users are recommended to upgrade to versions 11.0.18 or later, 10.1.52 or later or 9.0.115 or later which fix the issue.

Announced 17 Feb 2026Group revision 1

Original source ↗

DEBIAN-CVE-2026-24734

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:DEBIAN-CVE-2026-24734

tomcat10

Source reference: /affected/0/package/name

Affected versions: 10.1.10-1
Source reference: /affected/0/versions
10.1.13-1
Source reference: /affected/0/versions
10.1.14-1
Source reference: /affected/0/versions
10.1.15-1
Source reference: /affected/0/versions
10.1.16-1
Source reference: /affected/0/versions
10.1.20-1
Source reference: /affected/0/versions
10.1.23-1
Source reference: /affected/0/versions
10.1.25-1
Source reference: /affected/0/versions
10.1.25-1~bpo12+1
Source reference: /affected/0/versions
10.1.25-2
Source reference: /affected/0/versions
10.1.30-1
Source reference: /affected/0/versions
10.1.30-1~bpo12+1
Source reference: /affected/0/versions
10.1.31-1
Source reference: /affected/0/versions
10.1.33-1
Source reference: /affected/0/versions
10.1.33-1~bpo12+1
Source reference: /affected/0/versions
10.1.34-0+deb12u1
Source reference: /affected/0/versions
10.1.34-0+deb12u2
Source reference: /affected/0/versions
10.1.34-1
Source reference: /affected/0/versions
10.1.35-1
Source reference: /affected/0/versions
10.1.40-1
Source reference: /affected/0/versions
10.1.40-1~bpo12+1
Source reference: /affected/0/versions
10.1.46-1
Source reference: /affected/0/versions
10.1.6-1
Source reference: /affected/0/versions
10.1.6-1+deb12u1
Source reference: /affected/0/versions
10.1.6-1+deb12u2
Source reference: /affected/0/versions
10.1.7-1
Source reference: /affected/0/versions
10.1.8-1
Source reference: /affected/0/versions
10.1.9-1
Source reference: /affected/0/versions
Fixed versions: 10.1.52-1~deb12u1
Source reference: /affected/0/ranges
Prerequisites: Not stated in this record

tomcat10

Source reference: /affected/1/package/name

Affected versions: 10.1.40-1
Source reference: /affected/1/versions
10.1.46-1
Source reference: /affected/1/versions
10.1.52-1~deb12u1
Source reference: /affected/1/versions
Fixed versions: 10.1.52-1~deb13u1
Source reference: /affected/1/ranges
Prerequisites: Not stated in this record

tomcat10

Source reference: /affected/2/package/name

Affected versions: 10.1.40-1
Source reference: /affected/2/versions
10.1.46-1
Source reference: /affected/2/versions
10.1.52-1~deb12u1
Source reference: /affected/2/versions
10.1.52-1~deb13u1
Source reference: /affected/2/versions
Fixed versions: 10.1.52-1
Source reference: /affected/2/ranges
Prerequisites: Not stated in this record

tomcat11

Source reference: /affected/3/package/name

Affected versions: 11.0.11-1
Source reference: /affected/3/versions
11.0.15-1
Source reference: /affected/3/versions
11.0.15-1~deb13u1
Source reference: /affected/3/versions
11.0.18-1
Source reference: /affected/3/versions
11.0.21-1
Source reference: /affected/3/versions
11.0.6-1
Source reference: /affected/3/versions
Fixed versions: 11.0.22-1~deb13u1
Source reference: /affected/3/ranges
Prerequisites: Not stated in this record

tomcat11

Source reference: /affected/4/package/name

Affected versions: 11.0.11-1
Source reference: /affected/4/versions
11.0.15-1
Source reference: /affected/4/versions
11.0.15-1~deb13u1
Source reference: /affected/4/versions
11.0.6-1
Source reference: /affected/4/versions
Fixed versions: 11.0.18-1
Source reference: /affected/4/ranges
Prerequisites: Not stated in this record

tomcat9

Source reference: /affected/5/package/name

Affected versions: Not stated in this record
Fixed versions: 9.0.70-2
Source reference: /affected/5/ranges
Prerequisites: Not stated in this record

tomcat9

Source reference: /affected/6/package/name

Affected versions: Not stated in this record
Fixed versions: 9.0.70-2
Source reference: /affected/6/ranges
Prerequisites: Not stated in this record

tomcat9

Source reference: /affected/7/package/name

Affected versions: Not stated in this record
Fixed versions: 9.0.70-2
Source reference: /affected/7/ranges
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "10.1.52-1~deb12u1"
          }
        ]
      }
    ],
    "package": {
      "name": "tomcat10",
      "purl": "pkg:deb/debian/tomcat10?arch=source&distro=bookworm",
      "ecosystem": "Debian:12"
    },
    "versions": [
      "10.1.10-1",
      "10.1.13-1",
      "10.1.14-1",
      "10.1.15-1",
      "10.1.16-1",
      "10.1.20-1",
      "10.1.23-1",
      "10.1.25-1",
      "10.1.25-1~bpo12+1",
      "10.1.25-2",
      "10.1.30-1",
      "10.1.30-1~bpo12+1",
      "10.1.31-1",
      "10.1.33-1",
      "10.1.33-1~bpo12+1",
      "10.1.34-0+deb12u1",
      "10.1.34-0+deb12u2",
      "10.1.34-1",
      "10.1.35-1",
      "10.1.40-1",
      "10.1.40-1~bpo12+1",
      "10.1.46-1",
      "10.1.6-1",
      "10.1.6-1+deb12u1",
      "10.1.6-1+deb12u2",
      "10.1.7-1",
      "10.1.8-1",
      "10.1.9-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-24734.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "10.1.52-1~deb13u1"
          }
        ]
      }
    ],
    "package": {
      "name": "tomcat10",
      "purl": "pkg:deb/debian/tomcat10?arch=source&distro=trixie",
      "ecosystem": "Debian:13"
    },
    "versions": [
      "10.1.40-1",
      "10.1.46-1",
      "10.1.52-1~deb12u1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-24734.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "10.1.52-1"
          }
        ]
      }
    ],
    "package": {
      "name": "tomcat10",
      "purl": "pkg:deb/debian/tomcat10?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "versions": [
      "10.1.40-1",
      "10.1.46-1",
      "10.1.52-1~deb12u1",
      "10.1.52-1~deb13u1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-24734.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "11.0.22-1~deb13u1"
          }
        ]
      }
    ],
    "package": {
      "name": "tomcat11",
      "purl": "pkg:deb/debian/tomcat11?arch=source&distro=trixie",
      "ecosystem": "Debian:13"
    },
    "versions": [
      "11.0.11-1",
      "11.0.15-1",
      "11.0.15-1~deb13u1",
      "11.0.18-1",
      "11.0.21-1",
      "11.0.6-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-24734.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "11.0.18-1"
          }
        ]
      }
    ],
    "package": {
      "name": "tomcat11",
      "purl": "pkg:deb/debian/tomcat11?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "versions": [
      "11.0.11-1",
      "11.0.15-1",
      "11.0.15-1~deb13u1",
      "11.0.6-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-24734.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "9.0.70-2"
          }
        ]
      }
    ],
    "package": {
      "name": "tomcat9",
      "purl": "pkg:deb/debian/tomcat9?arch=source&distro=bookworm",
      "ecosystem": "Debian:12"
    },
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-24734.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "9.0.70-2"
          }
        ]
      }
    ],
    "package": {
      "name": "tomcat9",
      "purl": "pkg:deb/debian/tomcat9?arch=source&distro=trixie",
      "ecosystem": "Debian:13"
    },
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-24734.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "9.0.70-2"
          }
        ]
      }
    ],
    "package": {
      "name": "tomcat9",
      "purl": "pkg:deb/debian/tomcat9?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-24734.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  }
]

Publisher severity

No explicit severity was provided.

Event: #56688 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 16:46:07 GMT
Publisher date: Tue, 17 Feb 2026 19:21:56 GMT

Read the original announcement

Revision history

25 Oct 2026DEBIAN-CVE-2026-24734 · Revision 1Source updated