Key points
- Apache Tomcat 11.0.0-M14 through 11.0.26 is affected by the startup bypass.
- Apache Tomcat 10.1.22 through 10.1.60 contains the same vulnerability.
- Apache Tomcat 9.0.92 through 9.0.122 is also vulnerable to this issue.
Apache Tomcat administrators must verify their Federal Information Processing Standards (FIPS) configurations because a low-severity flaw allows the server to start even when FIPS mode activation fails. The issue affects multiple major version lines, including Tomcat 9, 10, and 11. According to the official advisory posted on the oss-security mailing list, the vulnerability is tracked as CVE-2026-74048. No patch has been confirmed yet for this specific failure mode in the provided material.
In plain English
The problem occurs when Apache Tomcat is configured to use FIPS-compliant cryptography via the OpenSSLLifecycleListener. If the system fails to activate FIPS mode correctly, Tomcat logs an error message but continues to start up anyway. Instead of shutting down to maintain security standards, the application proceeds using the standard Java Secure Socket Extension (JSSE) in non-FIPS mode. This behavior is described as "failing open," meaning the system remains operational but outside the required security posture.
The background
Mark Thomas posted the advisory to the oss-security mailing list on October 20. The report classifies the severity of CVE-2026-74048 as low. The flaw impacts Apache Tomcat 11.0.0-M14 through 11.0.26, version 10.1.22 through 10.1.60, and version 9.0.92 through 9.0.122. According to the advisory, the server uses the provided configuration in non-FIPS mode when the specific listener fails to enforce the stricter cryptographic standards required by FIPS.
What changes now
Organizations relying on Apache Tomcat for FIPS-compliant workloads need to audit their startup logs and listener configurations immediately. Since no fix is confirmed in the source material, teams should monitor for vendor updates. The risk is not remote code execution but rather a compliance failure where the system operates under weaker security guarantees than intended. Administrators must determine if their current deployments are silently running in non-FIPS mode due to this bypass.
Who needs to act first
Teams usually prioritize systems handling regulated data or requiring strict cryptographic compliance. Check whether your Tomcat instances are configured to enforce FIPS mode via the OpenSSLLifecycleListener. If so, verify that the activation process is succeeding and not just logging errors. Roll out configuration audits before applying any potential patches to ensure baseline compliance. Back up current server configurations to allow quick rollback if testing reveals stability issues. Reduce exposure by monitoring startup logs for specific FIPS activation failures.
What to do and how to stay safe: Apache Tomcat
- Review Apache Tomcat startup logs for errors related to FIPS activation or OpenSSLLifecycleListener failures.
- Verify that your Tomcat version falls within the affected ranges: 9.0.92-9.0.122, 10.1.22-10.1.60, or 11.0.0-M14-11.0.26.
- Monitor vendor channels for an official patch or configuration guidance to address CVE-2026-74048.
- Ensure your security monitoring alerts on Tomcat startup errors to detect silent non-FIPS operation.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Apache Tomcat versions are affected by CVE-2026-74048?
The vulnerability affects Apache Tomcat 11.0.0-M14 through 11.0.26, 10.1.22 through 10.1.60, and 9.0.92 through 9.0.122.
What is the severity rating for this vulnerability?
According to the advisory posted on the oss-security mailing list, the severity is rated as low.
Is there a patch available for this issue?
No fix has been confirmed yet in the provided source material.
