Apache Tomcat and Tomcat Native contain an improper input validation vulnerability in their OCSP response handling. This flaw allows bypassing certificate revocation checks because Tomcat Native and Tomcat's FFM port did not complete verification or freshness checks on OCSP responses. The vulnerability affects multiple versions of Apache Tomcat Native and Apache Tomcat. Fixed versions have been released to address this issue.