CVE-2026-53434 Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector
An attacker can bypass certificate revocation checks in Apache Tomcat FFM connectors due to improper error handling in CRL configuration.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53434?
CVE-2026-53434 is a critical vulnerability in Apache Tomcat, published on 29 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118.
Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.
Weakness: CWE-390
Which versions are affected by CVE-2026-53434?
7 open source packages ship an affected version, including org.apache.tomcat:tomcat-util and tomcat. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.tomcat:tomcat-util Maven | From 10.1.0-M7 | 10.1.56 |
org.apache.tomcat:tomcat-util Maven | From 10.1.0-M7 | 10.1.56 |
org.apache.tomcat:tomcat-util Maven | From 11.0.0-M1 | 11.0.23 |
org.apache.tomcat:tomcat-util Maven | From 11.0.0-M1 | 11.0.23 |
org.apache.tomcat:tomcat-util Maven | From 9.0.83 | 9.0.119 |
org.apache.tomcat:tomcat-util Maven | From 9.0.83 | 9.0.119 |
1 more packages
tomcat Bitnami | All versions | 9.0.101, 10.1.37, 11.0.5 |
Products include Apache Tomcat.
How do I fix CVE-2026-53434?
Upgrade org.apache.tomcat:tomcat-util to a fixed version for your release line: 10.1.56, 11.0.23 or 9.0.119.
Is CVE-2026-53434 being exploited?
There is no known exploitation of CVE-2026-53434 in the wild and no public exploit code.
Other vulnerabilities in Apache Tomcat
Sources
Also known as BIT-tomcat-2026-53434, DEBIAN-CVE-2026-53434, GHSA-4x29-79gh-6v8q, ROOT-APP-MAVEN-CVE-2026-53434, UBUNTU-CVE-2026-53434.