Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. (CVE-2026-74048)

This vulnerability (CVE-2026-74048) in Apache Tomcat occurs when the OpenSSLLifecycleListener is set to enforce FIPS mode but fails to activate it. Instead of failing securely by stopping or disabling the service, Tomcat logs an error and continues running with JSSE in non-FIPS mode using the provided configuration. This behavior is classified as 'Not Failing Securely' or 'Failing Open', which can lead to cryptographic operations not adhering to FIPS standards despite configuration, potentially weakening security guarantees. The issue affects specific versions across Tomcat 9, 10, and 11 branches and is resolved in later patch releases.

The impact is that cryptographic operations intended to comply with FIPS standards may instead run in a non-FIPS mode if FIPS activation fails, potentially exposing systems to weaker cryptographic protections than expected. This could undermine compliance and security policies relying on FIPS mode enforcement. There is no indication of active exploitation in the wild.

Users should upgrade to Apache Tomcat versions 11.0.27, 10.1.61, or 9.0.123 or later, where this issue is fixed. No other mitigation is indicated or required as the fix addresses the failure mode directly.