NewApp Monitoring is liveSign up free
AgentbeamBeta
Open-source package vulnerability · Maven

CVE-2026-53434: Apache Tomcat util accepted misconfigured CRLs

criticalCVSS 3.1 9.1GHSA-4x29-79gh-6v8q

Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring Certificate Revocation List (CRLs) for a FFM based connector. If an FFM connector was configured with invalid CRLs, the invalid CRLs were ignored meaning invalid certificates could be accepted. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118.

Published Jun 29, 2026 · Updated Oct 23, 2026

Affected packages

org.apache.tomcat:tomcat-util

Ecosystem
Maven
Affected
>= 11.0.0-M1, <= 11.0.22
Fixed in
11.0.23
Check
mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat-util

org.apache.tomcat:tomcat-util

Ecosystem
Maven
Affected
>= 10.1.0-M7, <= 10.1.55
Fixed in
10.1.56
Check
mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat-util

org.apache.tomcat:tomcat-util

Ecosystem
Maven
Affected
>= 9.0.83, <= 9.0.118
Fixed in
9.0.119
Check
mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat-util

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring Certificate Revocation List (CRLs) for a FFM based connector. If an FFM connector was configured with invalid CRLs, the invalid CRLs were ignored meaning invalid certificates could be accepted.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.

Credited to hara-satoshi-ymr.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology