CVE-2026-86248

Apache Tomcat: OCSP verification can fail open with OpenSSL FFM

Summary

The OpenSSL FFM integration can allow client certificate authentication to continue after certain OCSP failures even when soft-fail is disabled.

The issue affects Apache Tomcat 9.0.92 through 9.0.121 in the 9.0 branch and is fixed in Tomcat 9.0.122. The bundled version, 9.0.120, falls within this version range; exploitability depends on the conditions described below.

The Critical classification reflects the CISA assessment in the CVE record: 9.8 (CVSS 3.1). Apache rates this issue Moderate. The upstream severity is distinct from PageSeeder exposure.

For technical details, see the Apache Tomcat security advisory .

PageSeeder impact assessment

Assessment

PageSeeder is not affected by CVE-2026-86248 in the reviewed standard configuration because the required configuration or application usage was not found.

Required conditions for exploitation: Client certificate authentication using Tomcat’s OpenSSL FFM TLS implementation and OCSP verification with soft-fail disabled, in an affected failure scenario.

Relevant PageSeeder configuration: Windows and Linux installers do not configure OpenSSL FFM, OCSP or client certificate authentication. Optional Windows and legacy EL7 HTTPS connectors explicitly set clientAuth="false"; EL8/EL9 ship plaintext HTTP/1.1.

Evidence from source and configuration review:

• The supplied Docker connectors do not terminate TLS.
• No CLIENT-CERT authentication or matching OpenSSL FFM/OCSP configuration was found in the reviewed source.
• Customised TLS configurations and the installed Java runtime have not been inspected.
• Installer review confirms HTTP/1.1 connectors in windows/script/UpgradeFunctions.nsh (AddTomcatConnectors), linux/rpm/el7/includes/configure.sh and linux/rpm/el8/includes/bin/setup.sh (update_connector). No Http2Protocol or UpgradeProtocol is added.
• Linux EL8 and EL9 packages share the EL8 connector configuration through linux/build.gradle. Their supplied server.xml enables plaintext HTTP/1.1 on port 8282.
• Optional Windows and legacy EL7 HTTPS connectors explicitly disable client certificate authentication with clientAuth="false"; no OpenSSL FFM or OCSP configuration was found.

This assessment is limited to the repository revision and configuration reviewed on 11 November 2026. It does not independently verify the historical PageSeeder version range in the model advisory. Customised connectors, deployment descriptors, extensions and additional web applications may change exposure.

The PageSeeder installer source was also reviewed at commit a08323b (Windows, Linux EL7, EL8 and EL9). Installer review supports the standard configuration assessment; it does not establish the configuration of every deployed server. Linux RPM packaging marks server.xml CONFIG | NOREPLACE, so existing administrator changes can survive upgrades.

Recommended action

Administrators using client certificate authentication with OpenSSL FFM and OCSP should upgrade to Tomcat 9.0.122 or later, preferably 9.0.123 or later. Review the upstream advisory before relying on certificate revocation enforcement.

For installations matching the reviewed unaffected configuration, no CVE-specific emergency change is required. Confirm the installed configuration before relying on this conclusion. Use a supported PageSeeder distribution containing an updated Tomcat where available; this advisory does not announce a PageSeeder release date or confirm that such a distribution has shipped.

Dependency maintenance recommendation: update the bundled Tomcat to 9.0.123 or a later supported release, which also incorporates fixes for the other Critical CVEs covered in this advisory set.

References

• CVE-2026-86248 record and CISA severity assessment 
• Apache Tomcat security advisory 
• Apache Tomcat 9 security advisories 
• Apache Tomcat 9 changelog