# CVE-2026-53434: Apache Tomcat improper error handling in FFM connector CRL configuration

Source: https://junglewise.ai/threats/cve-2026-53434-apache-tomcat-improper-error-handling-in-ffm-connector-crl  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-29. Updated: 2026-06-29  
License: CC BY 4.0 with a link back

CVE-2026-53434 · Severity: critical · CVSS 9.1 · Published 2026-06-29

Apache Tomcat, a widely used web server and application container, contains a flaw in how it handles security certificate revocation lists (CRLs) when using specific modern connector configurations. If an error occurs while processing these lists, the system may fail to take appropriate action, potentially allowing revoked or invalid security certificates to be accepted. This could lead to unauthorized access or a breakdown in secure communications.

Technologies: [Apache Tomcat](https://junglewise.ai/threats/technologies/tomcat), [org.apache.tomcat:tomcat-util (Maven)](https://junglewise.ai/threats/technologies/org-apache-tomcat-tomcat-util). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-53434 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53434 being exploited in the wild.

**How severe is CVE-2026-53434?** Critical severity, with a CVSS score of 9.1, published 29 June 2026.

**Which products and versions are affected?** Apache Tomcat 11.0.0-M1 through 11.0.22, 10.1.0-M7 through 10.1.55, 9.0.83 through 9.0.118; org.apache.tomcat:tomcat-util (Maven) >= 11.0.0-M1, <= 11.0.22, ECOSYSTEM:introduced=11.0.0-M1,fixed=11.0.23.

**Is there a fix for CVE-2026-53434?** Yes. org.apache.tomcat:tomcat-util (Maven): upgrade to 11.0.23 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-53434 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-53434?** Check whether you run Apache Tomcat or org.apache.tomcat:tomcat-util (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.apache.tomcat:tomcat-util (Maven): upgrade to 11.0.23 or later

  ```sh
  # set org.apache.tomcat:tomcat-util to 11.0.23 in your pom.xml or build.gradle
  ```


## Technical details

Apache Tomcat is vulnerable to CWE-390 (Detection of Error Condition Without Action) within its Foreign Function Memory (FFM) based connector. When configuring Certificate Revocation Lists (CRLs), the application may detect an error condition but fail to execute the necessary security logic to handle it. This flaw could result in the failure to properly validate client certificates against revocation lists, potentially allowing revoked certificates to bypass security checks. The issue affects versions 11.0.0-M1 to 11.0.22, 10.1.0-M7 to 10.1.55, and 9.0.83 to 9.0.118. Users should upgrade to 11.0.23, 10.1.56, or 9.0.119 respectively.

## Affected products

- Apache Tomcat 11.0.0-M1 through 11.0.22, 10.1.0-M7 through 10.1.55, 9.0.83 through 9.0.118

## Identifiers

- CVE-2026-53434
- BIT-TOMCAT-2026-53434
- GHSA-4x29-79gh-6v8q

## Timeline

- 2026-06-29: advisory
- 2026-06-29: disclosed

## References

- [https://lists.apache.org/thread/x510lbq0sfrd1qyo7q3r1mpllgpdcosk](https://lists.apache.org/thread/x510lbq0sfrd1qyo7q3r1mpllgpdcosk)

## Related threats

- [Apache Tomcat Jakarta Security credential handler bypass](https://junglewise.ai/threats/cve-2026-111248-the-jakarta-security-identity-store-backed-by-the-tomcat-user)
- [Apache Tomcat incomplete cleanup in TLS 1.3 connections](https://junglewise.ai/threats/cve-2026-93446-incomplete-cleanup-vulnerability-in-apache-tomcat-could-cause-tls)
- [Apache Tomcat HTTP trailer information leak between requests](https://junglewise.ai/threats/cve-2026-88041-incomplete-cleanup-vulnerability-in-apache-tomcat-allowed-an)
- [Apache Tomcat TOCTOU race condition in APR/Native connector](https://junglewise.ai/threats/cve-2026-80353-time-of-check-time-of-use-toctou-race-condition-vulnerability-in)
- [Apache Tomcat Execution After Redirect vulnerability](https://junglewise.ai/threats/cve-2026-74049-execution-after-redirect-ear-vulnerability-in-apache-tomcat-this)