Skip to main content

Apache Tomcat EUVDEUVD-2026-40228

| CVE-2026-53434 CRITICAL
Detection of Error Condition Without Action (CWE-390)
2026-06-29 apache GHSA-4x29-79gh-6v8q
Information Disclosure Tomcat Apache Apache Tomcat Red Hat Suse
9.1
CVSS 3.1 · Vendor: apache
Share

Severity by source

Vendor (apache) PRIMARY
9.1 LOW
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
vuln.today AI
7.4 HIGH

Network-reachable client-auth bypass (AV:N, PR:N) but gated by a non-default FFM+CRL config and possession of a revoked trusted cert (AC:H); high C/I, no availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Red Hat
3.7 LOW
qualitative

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

5
Analysis Updated
Jun 30, 2026 - 13:28 vuln.today
v3 (cvss_changed)
Analysis Updated
Jun 30, 2026 - 13:28 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jun 30, 2026 - 13:22 vuln.today
cvss_changed
CVSS changed
Jun 30, 2026 - 13:22 NVD
9.1 (CRITICAL)
Analysis Generated
Jun 29, 2026 - 21:18 vuln.today

DescriptionCVE.org

Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.

Articles & Coverage 1

News Critical TLS Certificate Revocation Bypass in Apache Tomcat - CVE-2026-53434 Jun 30, 2026

AnalysisAI

Improper handling of a Certificate Revocation List (CRL) error condition in Apache Tomcat's FFM-based (Foreign Function & Memory / OpenSSL) connector allows revoked client certificates to be accepted during mutual TLS authentication, defeating revocation checking. The flaw affects Tomcat 9.0.83-9.0.118, 10.1.0-M7-10.1.55, and 11.0.0-M1-11.0.22 when a CRL is configured on the FFM connector, letting an attacker holding a revoked-but-otherwise-valid client certificate reach protected resources. There is no public exploit identified at time of analysis and the issue is not on CISA KEV, though the CVSS base score is 9.1 (CWE-390).

Technical ContextAI

Apache Tomcat introduced a connector built on the Java Foreign Function & Memory (FFM) API that binds to native OpenSSL for TLS termination, as an alternative to the JSSE and legacy APR/tcnative paths. When an administrator configures a Certificate Revocation List on this FFM connector to enforce client-certificate revocation, the code detects the error condition raised during CRL processing but fails to act on it (CWE-390, Detection of Error Condition Without Action). The practical consequence is that the revocation check is effectively a no-op: certificates that should be rejected as revoked are still treated as valid, undermining the trust guarantee of mutual TLS. The affected component is therefore the OpenSSL/FFM TLS connector specifically - the JSSE and APR connectors are not implicated by this description. CPE coverage is the broad cpe:2.3:a:apache_software_foundation:apache_tomcat:*, but only deployments using the FFM connector with CRLs are actually exposed.

RemediationAI

Vendor-released patch: upgrade to Apache Tomcat 11.0.23, 10.1.56, or 9.0.119 depending on your branch, as stated in the Apache advisory (https://lists.apache.org/thread/x510lbq0sfrd1qyo7q3r1mpllgpdcosk). If immediate upgrade is not possible, the most effective compensating control is to stop relying on the broken path: either switch the affected connector away from the FFM/OpenSSL implementation to the JSSE connector (which performs CRL handling independently of this defect), or move revocation checking to OCSP rather than CRL on the FFM connector - both change the TLS termination behavior and should be validated against performance and certificate-chain requirements before rollout. As a stronger interim measure, re-issue/rotate any client certificates and tighten CA issuance so that revocation reliance is reduced, and place the mutual-TLS endpoint behind an upstream reverse proxy or load balancer that enforces its own client-certificate revocation, accepting the added operational complexity and latency. Avoid simply disabling client-certificate authentication unless the application can tolerate the loss of that access control.

More in Tomcat

View all
CVE-2017-12617 HIGH POC
8.1 Oct 04

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
CVE-2023-47246 CRITICAL POC
9.8 Nov 10

In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a f
CVE-2016-8735 CRITICAL POC
9.8 Apr 06

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
CVE-2017-12615 HIGH POC
8.1 Sep 19

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. Rated high severity (CVSS 8.1), this

CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2014-0050 HIGH POC
7.5 Apr 01

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products,
CVE-2017-12616 HIGH
7.5 Sep 19

When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or

CVE-2014-0227 MEDIUM
6.4 Feb 16

java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and
CVE-2026-34486 HIGH POC
7.5 Apr 09

Missing encryption of cluster replication traffic in Apache Tomcat 11.0.20, 10.1.53, and 9.0.116 exposes sensitive sessi
CVE-2013-5528 MEDIUM POC
4.0 Oct 11

Directory traversal vulnerability in the Tomcat administrative web interface in Cisco Unified Communications Manager all
CVE-2016-6808 CRITICAL POC
9.8 Apr 12

Buffer overflow in Apache Tomcat Connectors (mod_jk) before 1.2.42. Rated critical severity (CVSS 9.8), this vulnerabili
CVE-2016-1240 HIGH POC
7.8 Oct 03

The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debia

Same weakness CWE-390 – Detection of Error Condition Without Action

View all
CVE-2025-26465 MEDIUM
6.8
CVE-2021-40391 CRITICAL POC
9.8
CVE-2019-5051 HIGH POC
8.8
CVE-2024-12086 MEDIUM POC
6.8
CVE-2026-52989 CRITICAL
9.8
CVE-2024-49841 HIGH
7.8
CVE-2024-30255 HIGH
7.5
CVE-2024-27919 HIGH
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Web and Scripting 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Server for SAP applications 16.0 Fixed
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 Fixed
openSUSE Leap 16.0 Fixed
openSUSE Tumbleweed Fixed

Share

EUVD-2026-40228 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy