Apache Tomcat FIPS Mode Bypass Leaves Server Non-Compliant on Startup Failure

Apache Tomcat environments configured for Federal Information Processing Standards compliance face a silent failure mode. When the OpenSSL-FFM FIPS activation process fails, the application server does not shut down. Instead, it proceeds to start using standard Java Secure Socket Extension libraries, operating outside the required cryptographic boundaries.

What happened

Mark Thomas posted an advisory to the oss-security mailing list on 20 October regarding CVE-2026-74048. The issue affects Apache Tomcat 11.0.0-M14 through 11.0.26, 10.1.22 through 10.1.60, and 9.0.92 through 9.0.122. The vulnerability is classified as low severity by the reporter. It stems from the OpenSSLLifecycleListener component, which is responsible for managing the FIPS mode state.

If the listener cannot activate FIPS mode, it logs an error message but does not halt the startup sequence. Consequently, Tomcat continues to operate with the provided configuration in non-FIPS mode. This behaviour contradicts the expectation that a failure in critical security configuration would prevent the service from starting.

Why it matters

Organisations relying on Tomcat for FIPS-compliant workloads may be exposed to non-compliant cryptographic operations without immediate awareness. The server appears to start successfully, masking the underlying configuration failure. Security teams monitoring for explicit shutdowns or fatal errors might miss this condition, as the application remains online. This creates a gap between the intended security posture and the actual runtime environment. The risk is primarily one of compliance and policy violation rather than immediate exploitation, as the server still uses JSSE, albeit in a non-FIPS configuration.

Next steps

• Review Tomcat logs for FIPS activation errors during recent startup cycles.
• Verify that OpenSSLLifecycleListener configurations are functioning as intended in test environments.
• Assess whether current monitoring alerts capture non-fatal cryptographic configuration failures.
• Monitor vendor channels for updates regarding this startup bypass issue.

Detection notes

Security operations teams should examine application logs for error messages related to FIPS activation failures. Look for entries indicating that the OpenSSLLifecycleListener encountered issues but did not terminate the process. Monitor for discrepancies between expected FIPS mode status and actual cryptographic provider behaviour.

Check whether automated compliance scans detect the server running in non-FIPS mode despite configuration settings. Review startup sequences for any silent fallback mechanisms that bypass security checks. Ensure that alerting thresholds capture configuration warnings that do not result in service interruption. Investigate any instances where the server remains online despite reported cryptographic setup errors.

What to do and how to stay safe: Apache Tomcat

• Audit Tomcat configurations to ensure FIPS mode requirements are strictly enforced.
• Monitor startup logs for errors related to OpenSSL-FFM FIPS activation failures.
• Implement alerts for non-fatal security configuration warnings in application logs.
• Test startup procedures in isolated environments to verify FIPS compliance behaviour.

Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Production

General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Apache Tomcat versions are affected by CVE-2026-74048?

Versions 11.0.0-M14 through 11.0.26, 10.1.22 through 10.1.60, and 9.0.92 through 9.0.122 are affected.

What is the severity rating for this vulnerability?

The vulnerability is rated as low severity according to the oss-security advisory.

Does Tomcat shut down if FIPS activation fails?

No, Tomcat logs an error but continues to start in non-FIPS mode using JSSE.