CVE-2026-74048: Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up

As cited

Copy frozen at 2026-10-20 19:25 UTC (site build).

vulnerabilities

CVE-2026-74048: Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up

Apache Tomcat CVE-2026-74048 is a low-severity vulnerability where the OpenSSLLifecycleListener fails to prevent server startup when FIPS mode activation fails, allowing Tomcat to continue running with JSSE in non-FIPS mode instead. Affected versions span Tomcat 9.0.92 through 11.0.26 across multiple release branches. The vulnerability represents a failure to enforce secure configuration rather than a cryptographic bypass.

Why it matters: Organizations requiring FIPS-validated cryptography should patch Tomcat to prevent accidental deployment in non-FIPS mode, which could violate compliance requirements or security policies.

Source published

2026-10-20 17:14 UTC

First seen by Cybersecurity Tracker

2026-10-20 18:31 UTC