NewNet Lithium (TextPassLGR) Tomcat 7.0.109: Assessment for CVE-2026-24733, CVE-2026-24734, and CVE-2025-66614 (RHEL 7.9 & RHEL 8)

Key Information

• Scope: Validate whether NewNet Lithium’s bundled Tomcat 7.0.109 (typically installed with TextPassLGR) is impacted by:
  • CVE-2026-24733 – HTTP/0.9 Security Constraint Bypass
  • CVE-2026-24734 – OCSP Certificate Revocation Bypass (Tomcat & Tomcat Native)
  • CVE-2025-66614 – Client Certificate Verification Bypass via SNI/Host mismatch
• Environment referenced:
  • Product: NewNet Lithium
  • Component: TextPassLGR (component that includes Tomcat in this deployment)
  • Tomcat: 7.0.109 (example path: /opt/TextPass/Apache/TextPassApache-tomcat-7.0.109/)
  • OS: Conclusions apply to RHEL 8 and RHEL 7.9 (Maipo) for the same product build/configuration
• Step 1 — Confirm whether TextPassLGR is installed:

  rpm -qa | grep -i TextPassLGR

  Interpretation:

  • If output includes a package similar to TextPassLGR-R<version>-<release>.x86_64 (example observed: TextPassLGR-R01.06.04.00-1.x86_64), then TextPassLGR is installed and Tomcat components may be present as part of that deployment.
  • If no output is returned, LGR is likely not installed on that server.
• Step 2 — Identify Tomcat install and baseline configuration files (typical locations):
  • .../conf/server.xml
  • .../conf/web.xml
  • .../logs/catalina.out
  • .../webapps/**/web.xml

• Example: /opt/TextPass/Apache/TextPassApache-tomcat-7.0.109/conf/server.xml

• Assessment summary (why the assessed deployment is not vulnerable):
  • CVE-2026-24734 (OCSP Certificate Revocation Bypass): Not applicable when Tomcat Native (APR/OpenSSL / libtcnative) is not installed/loaded, TLS uses JSSE, and clientAuth="false".
    • Supporting log evidence observed: "The Apache Tomcat Native library which allows using OpenSSL was not found on the java.library.path."
    • JSSE-based connector evidence: Http11NioProtocol with JKS keystore usage
  • CVE-2025-66614 (Client certificate verification bypass via SNI/Host mismatch): Not applicable in the assessed configuration because:
    • Only a single <Host> was present
    • clientAuth="false"
    • The affected Tomcat version range is commonly described as 8.5.0+, while this deployment uses Tomcat 7.0.109
  • CVE-2026-24733 (HTTP/0.9 security constraint bypass): Not applicable because:
    • HTTP/0.9 requests were not accepted in the manner required by the CVE (explicit HTTP/0.9 returned 505 HTTP Version Not Supported; requests without an HTTP version were dropped)
    • No <security-constraint> entries were present in any deployed or global web.xml
• Validation commands used in the assessment (adjust paths if your installation differs):
  • Check for Tomcat Native/APR references in logs:

    grep -i 'apr\|tcnative\|native' /opt/TextPass/Apache/TextPassApache-tomcat-7.0.109/logs/catalina.out

  • Confirm libtcnative is not present/installed:

    find / -name 'libtcnative*' 2>/dev/null
    rpm -qa | grep -i tcnative

  • Confirm HTTPS connector type and keystore usage:

    grep -A5 'Connector.*8443' /opt/TextPass/Apache/TextPassApache-tomcat-7.0.109/conf/server.xml

    Look for Http11NioProtocol and JKS keystore usage.

  • Confirm client certificate authentication setting:

    grep -i 'clientAuth' /opt/TextPass/Apache/TextPassApache-tomcat-7.0.109/conf/server.xml

    Expected in the assessed deployment: clientAuth="false"

  • Verify the number of <Host> blocks:

    grep -c '<Host ' /opt/TextPass/Apache/TextPassApache-tomcat-7.0.109/conf/server.xml

    Expected in the assessed deployment: 1

  • Search for security-constraint in app web.xml files:

    find /opt/TextPass/Apache/TextPassApache-tomcat-7.0.109/webapps/ -name web.xml -exec grep -l security-constraint {} \;

  • Check the global Tomcat web.xml:

    grep security-constraint /opt/TextPass/Apache/TextPassApache-tomcat-7.0.109/conf/web.xml

  • Validate HTTP/0.9 handling (perform only in approved testing windows):

    (printf 'GET / HTTP/1.0\r\nHost: 127.0.0.1\r\n\r\n'; sleep 2) | ncat 127.0.0.1 8080
    (printf 'GET /\r\n\r\n'; sleep 2) | ncat 127.0.0.1 8080
    (printf 'HEAD /\r\n\r\n'; sleep 2) | ncat 127.0.0.1 8080
    (printf 'GET / HTTP/0.9\r\n\r\n'; sleep 2) | ncat 127.0.0.1 8080
    (printf 'HEAD / HTTP/0.9\r\n\r\n'; sleep 2) | ncat 127.0.0.1 8080

    Expected evidence observed in the assessment: explicit HTTP/0.9 attempts return 505 HTTP Version Not Supported; version-less requests are dropped.

  • Optional SNI/Host mismatch probe (perform only in approved testing windows):

    openssl s_client -connect your_instance.domain.com:8443 -servername wrong.hostname.example.com

• Validation checklist (what “good” looks like):
  • rpm -qa | grep -i TextPassLGR confirms whether LGR is installed.
  • Tomcat Native is not installed/loaded (no libtcnative, no APR/OpenSSL usage).
  • HTTPS connector uses JSSE (Http11NioProtocol) and clientAuth="false".
  • Only one <Host> is present in server.xml.
  • No security-constraint entries exist in global or app web.xml.
  • HTTP/0.9 attempts return 505 HTTP Version Not Supported (or are otherwise not accepted as required by the CVE).