Loading vulnerability…
FIPS Activation Fail-Open in Apache Tomcat
CVE-2026-74048 is a fail-open vulnerability in Apache Tomcat's OpenSSL-FFM FIPS initialization. When OpenSSLLifecycleListener is configured to enable FIPS mode but activation fails, Tomcat logs an error and continues using JSSE in non-FIPS mode with the supplied configuration instead of preventing startup. This bypasses the configured FIPS requirement. Affected versions are 11.0.0-M14 through 11.0.26, 10.1.22 through 10.1.60, and 9.0.92 through 9.0.122.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Affected deployments can continue operating with non-FIPS cryptography despite being configured to require FIPS mode, violating cryptographic security policies and potentially compliance obligations. Apache classifies the vulnerability as Low severity. No direct code execution, data disclosure, or attacker-triggered exploitation mechanism is established.
If you can’t patch tonight, do this now.
No vendor-specified interim workaround is identified. As an operational precaution, verify successful FIPS activation before allowing the service to operate and stop or withhold service when activation fails. An activation error must not be treated as successful enforcement of FIPS mode.
Patch, then assume compromise.
Upgrade Apache Tomcat to 11.0.27, 10.1.61, or 9.0.123, or a later release within the corresponding branch.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.