This vulnerability in Apache Tomcat involves improper input validation related to the TLS Server Name Indication (SNI) extension and the HTTP Host header. When Tomcat is configured with multiple virtual hosts where some require client certificate authentication and others do not, an attacker can bypass client certificate authentication by sending different hostnames in the SNI extension and the HTTP Host header. The issue affects multiple versions across Tomcat 8.5, 9.0, 10.1, and 11.0 branches. The vulnerability is mitigated by upgrading to fixed versions 11.0.15+, 10.1.50+, or 9.0.113+.

An attacker can bypass client certificate authentication in configurations where it is enforced only at the Connector level and multiple virtual hosts have differing client certificate requirements. This could allow unauthorized access to resources protected by client certificate authentication, leading to potential confidentiality and integrity impacts. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, with high confidentiality and integrity impact but no availability impact.

Users should upgrade affected Apache Tomcat versions to 11.0.15 or later, 10.1.50 or later, or 9.0.113 or later, which include the fix for this vulnerability. If upgrading is not immediately possible, ensure that client certificate authentication is enforced at the web application level rather than only at the Connector level to mitigate the risk. Patch status is confirmed by the vendor advisory recommending these fixed versions.