CVE-2026-74048

A flaw was found in Apache Tomcat. When the server is configured to enforce FIPS (Federal Information Processing Standards) mode, a failure during FIPS activation causes Tomcat to log an error and continue running with standard non-FIPS cryptographic providers instead of terminating securely. This allows the application to process secure connections using unapproved or weaker cryptography, which may violate compliance mandates and weaken expected cryptographic protections.

A flaw was found in Apache Tomcat. When the OpenSSLLifecycleListener is configured to enforce FIPS mode and FIPS activation fails, Tomcat logs an error and continues running using non-FIPS JSSE cryptography rather than failing securely and terminating. An unauthenticated remote attacker can exploit this condition by establishing connections that use unapproved, non-compliant, or weaker cryptographic ciphers and algorithms, violating compliance mandates and degrading expected cryptographic assurances within the context of the running Tomcat daemon.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Configure automated startup monitoring or health-check scripts to verify Tomcat logs for OpenSSLLifecycleListener FIPS activation errors and terminate the process immediately upon failure, or ensure the underlying host operating system and JVM enforce FIPS mode globally.