{"id":"CVE-2026-53434","kind":"vulnerability","aliases":["CVE-2026-53434","GHSA-4x29-79gh-6v8q"],"related":[],"title":"Apache Tomcat util accepted misconfigured CRLs","description":"Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring Certificate Revocation List (CRLs) for a FFM based connector. If an FFM connector was configured with invalid CRLs, the invalid CRLs were ignored meaning invalid certificates could be accepted.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118.\n\nUsers are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.","summary":"Apache Tomcat's tomcat-util silently ignores invalid Certificate Revocation Lists on FFM-based connectors, so revoked or invalid client certificates can be accepted. An attacker holding a certificate that should have been revoked can authenticate over TLS.","severity":"critical","cvss":9.1,"epss":0.00586,"exploited":false,"exploited_at":null,"products":[{"name":"org.apache.tomcat:tomcat-util","fixed":["11.0.23"],"affected":">= 11.0.0-M1, <= 11.0.22","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat-util","fixed":["10.1.56"],"affected":">= 10.1.0-M7, <= 10.1.55","ecosystem":"maven"},{"name":"org.apache.tomcat:tomcat-util","fixed":["9.0.119"],"affected":">= 9.0.83, <= 9.0.118","ecosystem":"maven"},{"name":"apache tomcat","fixed":["9.0.119"],"affected":">= 9.0.83, < 9.0.119","ecosystem":"vendor"},{"name":"apache tomcat","fixed":["10.1.56"],"affected":">= 10.1.0, < 10.1.56","ecosystem":"vendor"},{"name":"apache tomcat","fixed":["11.0.23"],"affected":">= 11.0.0, < 11.0.23","ecosystem":"vendor"}],"ecosystems":["maven","vendor"],"tags":["cwe-390","java","maven","mutual-tls","package","tomcat"],"not_affected_if":["no-crl-configured","no-ffm-connector","not-using-client-certificates"],"how_to_check":"Check whether tomcat-util is on the classpath at an affected version (11.0.0-M1 to 11.0.22, 10.1.0-M7 to 10.1.55, 9.0.83 to 9.0.118).\nCheck whether a Tomcat connector uses the FFM implementation with a configured CRL.","fix":"Upgrade tomcat-util to 11.0.23, 10.1.56 or 9.0.119.\nUntil then, unknown for a workaround; sources do not say.","status":"open","published_at":"2026-06-29T21:16:44+00:00","first_seen_at":"2026-10-23T21:45:07+00:00","triaged_at":"2026-10-23T21:45:28+00:00","updated_at":"2026-10-23T23:44:52+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T21:45:28Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade tomcat-util to 11.0.23, 10.1.56 or 9.0.119.\nUntil then, unknown for a workaround; sources do not say.","reach":"network","impact":"high","summary":"Apache Tomcat's tomcat-util silently ignores invalid Certificate Revocation Lists on FFM-based connectors, so revoked or invalid client certificates can be accepted. An attacker holding a certificate that should have been revoked can authenticate over TLS.","category":"package","who_cares":["java","tomcat","maven","mutual-tls"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Revoked or invalid client certificates are accepted, bypassing mutual-TLS authentication.","analyst_note":"Confirm the exact FFM connector configuration that triggers the flaw and whether a workaround exists; see https://github.com/advisories/GHSA-4x29-79gh-6v8q.","how_to_check":"Check whether tomcat-util is on the classpath at an affected version (11.0.0-M1 to 11.0.22, 10.1.0-M7 to 10.1.55, 9.0.83 to 9.0.118).\nCheck whether a Tomcat connector uses the FFM implementation with a configured CRL.\nunknown for any other exposure check; sources do not give a command.","needs_analyst":true,"not_affected_if":["no-ffm-connector","no-crl-configured","not-using-client-certificates"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.00058,"input_tokens":3070,"output_tokens":545,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':8A,16A '-390':37B '-53434':9A,17A '10.1.0':137C '10.1.55':140C '10.1.56':153C '11.0.0':132C '11.0.22':135C '11.0.23':152C '4x29':12A '6v8q':14A '79gh':13A '9.0.118':144C '9.0.119':155C '9.0.83':142C 'accept':4A,70B,125C 'action':90C 'affect':128C 'apach':1A,45B,93C,129C 'apache':30A,32A,34A 'attack':72B 'authent':82B 'base':60B,104C 'certif':54B,67B,75B,97C,122C 'client':66B 'condit':88C 'configur':96C,111C 'connector':61B,105C,109C 'could':123C 'crls':6A,100C,114C,117C 'cve':7A,15A 'cwe':36B 'detect':85C 'error':87C 'ffm':59B,103C,108C 'ffm-base':58B 'fix':157C 'ghsa':11A 'ghsa-4x29-79gh-6v8q':10A 'hold':73B 'ignor':52B,119C 'invalid':53B,65B,113C,116C,121C 'issu':127C,159C 'java':38B 'list':56B,99C 'm1':133C 'm7':138C 'maven':39B 'mean':120C 'misconfigur':5A 'mutual':41B 'mutual-tl':40B 'org.apache.tomcat':18A,22A,26A 'packag':43B 'recommend':147C 'revoc':55B,98C 'revok':63B,80B 'silent':51B 'tls':42B,84B 'tomcat':2A,20A,24A,28A,31A,33A,35A,44B,46B,49B,94C,130C 'tomcat-util':19A,23A,27A,48B 'upgrad':149C 'user':145C 'util':3A,21A,25A,29A,50B 'version':151C 'vulner':91C 'without':89C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-06-29T21:16:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-4x29-79gh-6v8q","url":"https://github.com/advisories/GHSA-4x29-79gh-6v8q","severity":"critical","published_at":"2026-06-29T21:32:15+00:00","modified_at":"2026-10-23T21:42:44+00:00","first_seen_at":"2026-10-23T21:45:07+00:00","fetched_at":"2026-10-23T21:45:07+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-53434","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53434","severity":null,"published_at":"2026-06-29T21:16:44+00:00","modified_at":"2026-07-02T19:06:09+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}