{"id":"CVE-2026-53434","aliases":["BIT-tomcat-2026-53434","GHSA-4x29-79gh-6v8q"],"url":"https://o3.security/vulnerability/CVE-2026-53434","summary":"Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector","details":"Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring Certificate Revocation List (CRLs) for a FFM based connector. If an FFM connector was configured with invalid CRLs, the invalid CRLs were ignored meaning invalid certificates could be accepted.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118.\n\nUsers are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.","published":"2026-06-29T20:41:06.948Z","modified":"2026-10-23T22:10:52.881417181Z","cvss":{"score":9.1,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.apache.tomcat:tomcat-util","fixedVersion":"11.0.23"},{"ecosystem":"Maven","name":"org.apache.tomcat:tomcat-util","fixedVersion":"10.1.56"},{"ecosystem":"Maven","name":"org.apache.tomcat:tomcat-util","fixedVersion":"9.0.119"}],"fix":{"url":"https://github.com/apache/tomcat/commit/7f8ecdbd930d8c5a7fae73aa0eec9124d919e2f5","label":"apache/tomcat@7f8ecdb"},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/06/29/22"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53434.json"},{"type":"ADVISORY","url":"https://lists.apache.org/thread/x510lbq0sfrd1qyo7q3r1mpllgpdcosk"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53434"},{"type":"WEB","url":"https://github.com/apache/tomcat/commit/7f8ecdbd930d8c5a7fae73aa0eec9124d919e2f5"},{"type":"WEB","url":"https://github.com/apache/tomcat/commit/c48ac39c27f4494f8c96b9d56a487253e362d276"},{"type":"WEB","url":"https://github.com/apache/tomcat/commit/feec60d6099727db6f911534f6a0f6926ebab070"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-23T22:10:52.881417181Z"}}