[GHSA-mgp5-rv84-w37q] Apache Tomcat has an Improper Input Validation vulnerability

[levpachmanov]

Updates

• Affected products
• References

Comments
The Java-side fix for CVE-2026-24734 (apache/tomcat commit e76e9eaa) changes only two production files, both under java/org/apache/tomcat/util/net/openssl/panama/: OpenSSLContext.java and OpenSSLEngine.java, where processOCSP() / processOCSPRequest() gain the OCSP nonce check, OCSP_basic_verify(), OCSP_check_validity() and a request timeout. The JNI/tomcat-native OpenSSL classes (org/apache/tomcat/util/net/openssl/*, no panama) are untouched; that side is covered by tomcat-native 69a977dd.

Those Panama/FFM classes are packaged into org.apache.tomcat:tomcat-coyote-ffm, which the advisory does not list at all. In build.xml, patternset id="files.tomcat-coyote" carries an explicit <exclude name="org/apache/tomcat/util/net/openssl/panama/**"/>, and files.tomcat-coyote-ffm is the patternset that includes them.

Verified by inventorying the published jars on Maven Central (unzip -l <jar> | grep -c openssl/panama):

• tomcat-coyote-ffm 9.0.113, 10.1.50, 11.0.15 → 25 panama classes + 213 org/apache/tomcat/util/openssl/* entries each.
• tomcat-embed-core 9.0.113, 10.1.50, 11.0.15 → 0 panama classes (they contain only the JNI util/net/openssl/* classes, which the fix does not touch). Same result for 9.0.93 / 9.0.95 / 9.0.100 / 9.0.110, 10.1.28 / 10.1.31 / 10.1.34 / 10.1.36 / 10.1.40 / 10.1.44, 11.0.0 / 11.0.5 / 11.0.9 / 11.0.12, 11.0.0-M24 / M25 / M26.
• tomcat-coyote 9.0.93, 9.0.113, 10.1.26, 10.1.50, 11.0.0-M22 → 0 panama classes.

The Panama OpenSSL implementation, including the vulnerable processOCSP code, first appears in the source tree at 9.0.92, 10.1.22 and 11.0.0-M14 — not at 9.0.83 / 10.1.0-M7 / 11.0.0-M1. java/org/apache/tomcat/util/net/openssl/panama/OpenSSLEngine.java does not exist at tags 9.0.83 / 9.0.85 / 9.0.87 / 9.0.88 / 9.0.90 / 9.0.91, 10.1.0-M7 / 10.1.0 / 10.1.5 / 10.1.10 / 10.1.15 / 10.1.20 / 10.1.21, or 11.0.0-M1 / M5 / M10 / M12 / M13.

Before the tomcat-coyote-ffm jar was split out, the classes shipped in tomcat-coyote (10.1.23–10.1.25, 11.0.0-M14–11.0.0-M21) and in tomcat-embed-core (10.1.23–10.1.26, 11.0.0-M20–11.0.0-M22), which is why those two artifacts keep narrow ranges. No 9.0.x release of either artifact is affected: Panama support landed on the 9.0 branch at 9.0.92 (never published) and the ffm split was already in place by 9.0.93.

The tomcat-embed-core and tomcat-coyote entries have no patched version because there is no fixed release of those artifacts — exposure ended by repackaging, at 10.1.28 / 11.0.0-M24 and 10.1.26 / 11.0.0-M22 respectively.

Suggested affected products:

Package	Affected versions	Patched
org.apache.tomcat:tomcat-coyote-ffm	>= 9.0.93, < 9.0.115	9.0.115
org.apache.tomcat:tomcat-coyote-ffm	>= 10.1.26, < 10.1.52	10.1.52
org.apache.tomcat:tomcat-coyote-ffm	>= 11.0.0-M22, < 11.0.18	11.0.18
org.apache.tomcat.embed:tomcat-embed-core	>= 10.1.23, <= 10.1.26	none
org.apache.tomcat.embed:tomcat-embed-core	>= 11.0.0-M20, <= 11.0.0-M22	none
org.apache.tomcat:tomcat-coyote	>= 10.1.23, <= 10.1.25	none
org.apache.tomcat:tomcat-coyote	>= 11.0.0-M14, <= 11.0.0-M21	none

Note: versions 9.0.92, 10.1.21, 10.1.22, 10.1.27, 10.1.51, 11.0.0-M23, 11.0.16 and 11.0.17 were never published to Maven Central, so the range endpoints above are stated at the nearest published release.

Exploitation additionally requires Java 22+ with the FFM OpenSSL implementation enabled (OpenSSLLifecycleListener), since the Panama classes are compiled only under the has-ffm condition in build.xml.