{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-06-10T17:17:17.482","vulnerabilities":[{"cve":{"id":"CVE-2026-29145","sourceIdentifier":"security@apache.org","published":"2026-04-09T20:16:24.447","lastModified":"2026-04-14T13:22:28.357","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0.83 through 9.0.115; Apache Tomcat Native: from 1.1.23 through 1.1.34, from 1.2.0 through 1.2.39, from 1.3.0 through 1.3.6, from 2.0.0 through 2.0.13.\n\nUsers are recommended to upgrade to version Tomcat Native 1.3.7 or 2.0.14 and Tomcat 11.0.20, 10.1.53 and 9.0.116, which fix the issue."}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*","versionStartIncluding":"9.0.83","versionEndExcluding":"9.0.116","matchCriteriaId":"2F4C25F3-54B7-42C3-9CEE-853D64F538B9"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*","versionStartIncluding":"10.1.1","versionEndExcluding":"10.1.53","matchCriteriaId":"6A9752F3-66FC-41BC-BBB9-50AC9A7DBC55"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*","versionStartIncluding":"11.0.0","versionEndExcluding":"11.0.20","matchCriteriaId":"1F39B82B-0E67-459D-8065-2C6EE7970D0D"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:10.1.0:-:*:*:*:*:*:*","matchCriteriaId":"8AF99366-B85F-447F-90EF-E4F163193A78"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:10.1.0:milestone10:*:*:*:*:*:*","matchCriteriaId":"33C71AE1-B38E-4783-BAC2-3CDA7B4D9EBA"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:10.1.0:milestone11:*:*:*:*:*:*","matchCriteriaId":"F6BD4180-D3E8-42AB-96B1-3869ECF47F6C"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:10.1.0:milestone12:*:*:*:*:*:*","matchCriteriaId":"64668CCF-DBC9-442D-9E0F-FD40E1D0DDB7"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:10.1.0:milestone13:*:*:*:*:*:*","matchCriteriaId":"FC64BB57-4912-481E-AE8D-C8FCD36142BB"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:10.1.0:milestone14:*:*:*:*:*:*","matchCriteriaId":"49B43BFD-6B6C-4E6D-A9D8-308709DDFB44"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:10.1.0:milestone15:*:*:*:*:*:*","matchCriteriaId":"919C16BD-79A7-4597-8D23-2CBDED2EF615"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:10.1.0:milestone16:*:*:*:*:*:*","matchCriteriaId":"81B27C03-D626-42EC-AE4E-1E66624908E3"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:10.1.0:milestone17:*:*:*:*:*:*","matchCriteriaId":"BD81405D-81A5-4683-A355-B39C912DAD2D"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:10.1.0:milestone18:*:*:*:*:*:*","matchCriteriaId":"2DCE3576-86BC-4BB8-A5FB-1274744DFD7F"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:10.1.0:milestone19:*:*:*:*:*:*","matchCriteriaId":"5571F54A-2EAC-41B6-BDA9-7D33CFE97F70"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:10.1.0:milestone20:*:*:*:*:*:*","matchCriteriaId":"ED30E850-C475-4133-BDE3-74CB3768D787"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:10.1.0:milestone7:*:*:*:*:*:*","matchCriteriaId":"941FCF7B-FFB6-4967-95C7-BB3D32C73DAF"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:10.1.0:milestone8:*:*:*:*:*:*","matchCriteriaId":"CE1A9030-B397-4BA6-8E13-DA1503872DDB"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat:10.1.0:milestone9:*:*:*:*:*:*","matchCriteriaId":"6284B74A-1051-40A7-9D74-380FEEEC3F88"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat_native:*:*:*:*:*:*:*:*","versionStartIncluding":"1.1.23","versionEndExcluding":"1.3.7","matchCriteriaId":"4285FB15-C93B-498C-9DA1-E5C3364A0280"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat_native:*:*:*:*:*:*:*:*","versionStartIncluding":"2.0.0","versionEndExcluding":"2.0.14","matchCriteriaId":"89778321-0002-4D5F-85DB-EAE3CB9B53CA"}]}]}],"references":[{"url":"https://lists.apache.org/thread/yz5fxmhd2j43wgqykssdo7kltws57jfz","source":"security@apache.org","tags":["Mailing List","Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/04/09/23","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}}]}