---
id: "CVE-2026-53434"
kind: "vulnerability"
aliases: ["CVE-2026-53434", "GHSA-4x29-79gh-6v8q"]
title: "Apache Tomcat util accepted misconfigured CRLs"
severity: "critical"
cvss: 9.1
epss: 0.00586
exploited: false
status: "open"
category: "package"
products: [{"name": "org.apache.tomcat:tomcat-util", "fixed": ["11.0.23"], "affected": ">= 11.0.0-M1, <= 11.0.22", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat-util", "fixed": ["10.1.56"], "affected": ">= 10.1.0-M7, <= 10.1.55", "ecosystem": "maven"}, {"name": "org.apache.tomcat:tomcat-util", "fixed": ["9.0.119"], "affected": ">= 9.0.83, <= 9.0.118", "ecosystem": "maven"}, {"name": "apache tomcat", "fixed": ["9.0.119"], "affected": ">= 9.0.83, < 9.0.119", "ecosystem": "vendor"}, {"name": "apache tomcat", "fixed": ["10.1.56"], "affected": ">= 10.1.0, < 10.1.56", "ecosystem": "vendor"}, {"name": "apache tomcat", "fixed": ["11.0.23"], "affected": ">= 11.0.0, < 11.0.23", "ecosystem": "vendor"}]
ecosystems: ["maven", "vendor"]
tags: ["cwe-390", "java", "maven", "mutual-tls", "package", "tomcat"]
not_affected_if: ["no-crl-configured", "no-ffm-connector", "not-using-client-certificates"]
published_at: "2026-06-29T21:16:44+00:00"
first_seen_at: "2026-10-23T21:45:07+00:00"
updated_at: "2026-10-23T23:44:52+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-4x29-79gh-6v8q", "first_seen_at": "2026-10-23T21:45:07+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53434", "first_seen_at": "2026-10-23T23:44:52+00:00"}]
---

# Apache Tomcat util accepted misconfigured CRLs

Apache Tomcat's tomcat-util silently ignores invalid Certificate Revocation Lists on FFM-based connectors, so revoked or invalid client certificates can be accepted. An attacker holding a certificate that should have been revoked can authenticate over TLS.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:org.apache.tomcat:tomcat-util affected >= 11.0.0-M1, <= 11.0.22 fixed 11.0.23
- maven:org.apache.tomcat:tomcat-util affected >= 10.1.0-M7, <= 10.1.55 fixed 10.1.56
- maven:org.apache.tomcat:tomcat-util affected >= 9.0.83, <= 9.0.118 fixed 9.0.119
- vendor:apache tomcat affected >= 9.0.83, < 9.0.119 fixed 9.0.119
- vendor:apache tomcat affected >= 10.1.0, < 10.1.56 fixed 10.1.56
- vendor:apache tomcat affected >= 11.0.0, < 11.0.23 fixed 11.0.23

## How to check

Check whether tomcat-util is on the classpath at an affected version (11.0.0-M1 to 11.0.22, 10.1.0-M7 to 10.1.55, 9.0.83 to 9.0.118).
Check whether a Tomcat connector uses the FFM implementation with a configured CRL.

## Fix

Upgrade tomcat-util to 11.0.23, 10.1.56 or 9.0.119.
Until then, unknown for a workaround; sources do not say.

## Timeline

- 2026-10-23T21:45:07+00:00 ghsa https://github.com/advisories/GHSA-4x29-79gh-6v8q
- 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-53434

## From the sources

Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring Certificate Revocation List (CRLs) for a FFM based connector. If an FFM connector was configured with invalid CRLs, the invalid CRLs were ignored meaning invalid certificates could be accepted.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_