CVE-2026-86248

A flaw was found in Apache Tomcat. When client certificate authentication is configured with strict certificate revocation checking, Online Certificate Status Protocol (OCSP) verification may improperly allow connections instead of failing as intended. A remote attacker presenting an invalid or revoked client certificate could exploit this issue to bypass authentication and gain unauthorized access to protected resources.

This issue only affects Tomcat builds with FFM support enabled. In Red Hat Enterprise Linux, this support is only available in Tomcat package in Red Hat Enterprise Linux versions 9.8 and later, and 10.2 and later, as the feature require Java 22 or later.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.