CVE-2026-74048 Apache Software Foundation CVE debrief

Who should care

Apache Tomcat users and administrators who have configured OpenSSLLifecycleListener to use FIPS mode. These users should be aware of the Not Failing Securely ('Failing Open') vulnerability and take action to upgrade to a fixed version or review and update their OpenSSLLifecycleListener configuration to ensure FIPS mode activation.

Why it matters

Apache Tomcat users and administrators should be aware of the Not Failing Securely ('Failing Open') vulnerability and take action to upgrade to a fixed version or review and update their OpenSSLLifecycleListener configuration to ensure FIPS mode activation.

• Potential security risks due to FIPS mode not being activated
• Non-FIPS mode usage with provided configuration after FIPS activation failure
• Need for review and update of OpenSSLLifecycleListener configuration
• Verification of FIPS mode activation required

Technical summary

The OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs an error but continues to use JSSE in non-FIPS mode with the provided configuration. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.26, from 10.1.22 through 10.1.60, from 9.0.92 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue. The vulnerability is a Not Failing Securely ('Failing Open') issue, which can lead to potential security risks due to FIPS mode not being activated.

Defensive priority

Medium

Recommended defensive actions

• Upgrade to version 11.0.27, 10.1.61 or 9.0.123
• Review and update OpenSSLLifecycleListener configuration
• Verify FIPS mode activation
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and source item provide details on the Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. The OpenSSLLifecycleListener is configured to use FIPS mode but FIPS activation fails, Tomcat logs an error but continues to use JSSE in non-FIPS mode with the provided configuration. Evidence is limited to CVE Program and NVD records.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.