CVE-2018-8020: Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 has a flaw that does not properly check OCSP pre-...

Security readout for executives and security teams

This flaw affects Apache Tomcat Native when mutual TLS depends on OCSP checks to reject revoked client certificates. In affected versions, some pre-produced OCSP responses with multiple certificate-status entries may be mishandled, so a revoked client certificate could still authenticate. Organizations not using OCSP checks are not affected, per the CVE description. Exposure is most likely on Tomcat deployments using Apache Tomcat Native for TLS, requiring mutual TLS, and enabling OCSP checks. Deployments without OCSP checks are stated as unaffected. Evidence does not identify broad internet-wide exposure. Prioritize remediation where mTLS protects sensitive services, partner access, administration, or regulated workflows. For systems without OCSP checks or without client-certificate authentication, business urgency is lower but inventory validation is still warranted. Mitigation focus: Upgrade Apache Tomcat Native outside the affected version ranges using vendor guidance.; Apply relevant OS vendor security updates, including Red Hat or Debian packages where applicable.; Review Tomcat TLS configurations that require client certificates and OCSP revocation checks..

Prepared

Jun 7, 2026, 05:54 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.