The vulnerability CVE-2026-24734 in Apache Tomcat involves a certificate revocation bypass caused by improper validation of OCSP (Online Certificate Status Protocol) responses. This issue affects Red Hat Enterprise Linux 10 Tomcat packages across various architectures (x86_64, s390x, ppc64le, aarch64). Red Hat has issued an important security advisory (RHSA-2026:19054) and released updated Tomcat packages (version 10.1.49-1.el10_2.1) that fix this vulnerability. The advisory references CWE-295 (Improper Certificate Validation) and provides detailed remediation instructions. No CVSS score is provided in the advisory, but the severity is rated as important.

The vulnerability allows an attacker to bypass certificate revocation checks by exploiting improper OCSP response validation in Apache Tomcat. This could lead to acceptance of revoked certificates, potentially enabling man-in-the-middle attacks or other TLS-related security breaches. The impact is significant for systems relying on Tomcat for secure communications, as trust in certificate validity is compromised.

Red Hat has released updated Tomcat packages (version 10.1.49-1.el10_2.1) that address this vulnerability. Users should apply these official updates promptly according to the instructions in the Red Hat advisory (https://access.redhat.com/articles/11258). No additional mitigations are indicated or required beyond applying the provided patch. Patch status is confirmed as available and official.