Executive brief
Apache Tomcat is a widely-used web server that handles secure HTTPS connections. This vulnerability causes Tomcat to ignore certificate revocation lists (CRLs) when checking whether client or server certificates are still valid, potentially allowing revoked certificates to be accepted as legitimate. An attacker with a revoked certificate could impersonate trusted servers or clients, bypassing authentication controls.
Technical details
The OpenSSL and OpenSSL-FFM TLS implementations in Tomcat fail to validate CRLs when a certificate is loaded from a keystore, allowing revoked certificates to be treated as valid. This affects TLS connections where certificate revocation checking is required. The vulnerability requires no user interaction and affects both inbound and outbound TLS connections; fixes are available in versions 11.0.26, 10.1.59, and 9.0.122.
Affected products
- Apache Tomcat 8.5.0 through 8.5.100, 9.0.0-M1 through 9.0.121, 10.1.0-M1 through 10.1.58, 11.0.0-M1 through 11.0.25
Timeline
- 2026-09-23: disclosed
- 2026-09-23: patched: Fixed in versions 11.0.26, 10.1.59, 9.0.122