CyberRota Analysis
AI-GeneratedApache Tomcat versions 11.0.0-M14 to 11.0.25, 10.1.22 to 10.1.59, and 9.0.92 to 9.0.121 are vulnerable due to a failure in CLIENT_CERT authentication when soft fail is disabled, potentially allowing unauthorized access. This critical vulnerability, rated 9.8 on the CVSS scale, poses a significant risk to organizations relying on these versions for secure client authentication. Administrators of affected Apache Tomcat instances should prioritize upgrading to the patched versions 11.0.26, 10.1.60, or 9.0.122 to mitigate this risk.
Original NVD Description
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from 10.1.22 through 10.1.59, from 9.0.92 through 9.0.121. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.