This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-86248 →
DEBIAN-CVE-2026-86248
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat. This issue affec...
Original description
The description as published by the source.
CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from 10.1.22 through 10.1.59, from 9.0.92 through 9.0.121. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Debian:12
tomcat10
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:13
tomcat10
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:14
tomcat10
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.60-1"}]}]
Debian:13
tomcat11
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:14
tomcat11
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:12
tomcat9
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.70-2"}]}]
Debian:13
tomcat9
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.70-2"}]}]
Debian:14
tomcat9
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.70-2"}]}]
References
- advisory security-tracker.debian.org