CVE-2026-53434: Apache Tomcat improper error handling in FFM connector CRL configuration

CVE-2026-53434 · Severity: critical · CVSS 9.1 · Published 2026-06-29

Apache Tomcat, a widely used web server and application container, contains a flaw in how it handles security certificate revocation lists (CRLs) when using specific modern connector configurations. If an error occurs while processing these lists, the system may fail to take appropriate action, potentially allowing revoked or invalid security certificates to be accepted. This could lead to unauthorized access or a breakdown in secure communications.

Technologies: Apache Tomcat, org.apache.tomcat:tomcat-util (Maven). Vendors: Apache, Maven.

Quick answers

Is CVE-2026-53434 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-53434 being exploited in the wild.
How severe is CVE-2026-53434?
Critical severity, with a CVSS score of 9.1, published 29 June 2026.
Which products and versions are affected?
Apache Tomcat 11.0.0-M1 through 11.0.22, 10.1.0-M7 through 10.1.55, 9.0.83 through 9.0.118; org.apache.tomcat:tomcat-util (Maven) >= 11.0.0-M1, <= 11.0.22, ECOSYSTEM:introduced=11.0.0-M1,fixed=11.0.23.
Is there a fix for CVE-2026-53434?
Yes. org.apache.tomcat:tomcat-util (Maven): upgrade to 11.0.23 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53434 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-53434?
Check whether you run Apache Tomcat or org.apache.tomcat:tomcat-util (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.tomcat:tomcat-util (Maven): upgrade to 11.0.23 or later
    # set org.apache.tomcat:tomcat-util to 11.0.23 in your pom.xml or build.gradle

Technical details

Apache Tomcat is vulnerable to CWE-390 (Detection of Error Condition Without Action) within its Foreign Function Memory (FFM) based connector. When configuring Certificate Revocation Lists (CRLs), the application may detect an error condition but fail to execute the necessary security logic to handle it. This flaw could result in the failure to properly validate client certificates against revocation lists, potentially allowing revoked certificates to bypass security checks. The issue affects versions 11.0.0-M1 to 11.0.22, 10.1.0-M7 to 10.1.55, and 9.0.83 to 9.0.118. Users should upgrade to 11.0.23, 10.1.56, or 9.0.119 respectively.

Affected products

  • Apache Tomcat 11.0.0-M1 through 11.0.22, 10.1.0-M7 through 10.1.55, 9.0.83 through 9.0.118

Identifiers

  • CVE-2026-53434
  • BIT-TOMCAT-2026-53434
  • GHSA-4x29-79gh-6v8q

Timeline

  • 2026-06-29: advisory
  • 2026-06-29: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.