Apache Tomcat Native and Apache Tomcat contain an improper input validation vulnerability (CWE-20, CWE-295) related to OCSP responder handling. Specifically, when using an OCSP responder, the affected versions do not complete verification or freshness checks on the OCSP response, which could allow an attacker to bypass certificate revocation checks. The vulnerability affects Apache Tomcat Native versions from 1.3.0 through 1.3.4 and 2.0.0 through 2.0.11, as well as Apache Tomcat versions 11.0.0-M1 through 11.0.17, 10.1.0-M7 through 10.1.51, and 9.0.83 through 9.0.114. Older EOL versions from 1.1.23 through 1.1.34 and 1.2.0 through 1.2.39 are also known to be affected. The issue is fixed in Apache Tomcat Native 1.3.5 or later and 2.0.12 or later, and Apache Tomcat 11.0.18 or later, 10.1.52 or later, and 9.0.115 or later. Red Hat has issued advisories and updates addressing this vulnerability in their JBoss Web Server product.

The vulnerability allows bypassing of certificate revocation checks via OCSP response validation failures. This can lead to acceptance of revoked certificates, potentially enabling man-in-the-middle or impersonation attacks where revoked certificates would normally be rejected. The CVSS v3.1 base score is 7.4 (High), reflecting network attack vector, high impact on confidentiality and integrity, and no user interaction required.

A fix is available. Users should upgrade Apache Tomcat Native to version 1.3.5 or later, or 2.0.12 or later. Apache Tomcat should be upgraded to version 11.0.18 or later, 10.1.52 or later, or 9.0.115 or later. Red Hat users should apply the relevant security updates for JBoss Web Server as detailed in Red Hat advisory RHSA-2026:5611. No other mitigation actions are specified by the vendor.