# CVE-2026-73581: Apache Tomcat certificate revocation check bypass in TLS

Source: https://junglewise.ai/threats/cve-2026-73581-improper-check-for-certificate-revocation-vulnerability-in-apache  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-73581 · Severity: medium · CVSS 6.5 · Published 2026-09-23

Apache Tomcat is a widely-used web server that handles secure HTTPS connections. This vulnerability causes Tomcat to ignore certificate revocation lists (CRLs) when checking whether client or server certificates are still valid, potentially allowing revoked certificates to be accepted as legitimate. An attacker with a revoked certificate could impersonate trusted servers or clients, bypassing authentication controls.

Technologies: [Apache Tomcat](https://junglewise.ai/threats/technologies/tomcat). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-73581 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73581 being exploited in the wild.

**How severe is CVE-2026-73581?** Medium severity, with a CVSS score of 6.5, published 23 September 2026.

**Which products and versions are affected?** Apache Tomcat 8.5.0 through 8.5.100, 9.0.0-M1 through 9.0.121, 10.1.0-M1 through 10.1.58, 11.0.0-M1 through 11.0.25.

**Is there a fix for CVE-2026-73581?** A patch was published on 2026-09-23: Fixed in versions 11.0.26, 10.1.59, 9.0.122 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73581 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-73581?** Check whether you run Apache Tomcat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The OpenSSL and OpenSSL-FFM TLS implementations in Tomcat fail to validate CRLs when a certificate is loaded from a keystore, allowing revoked certificates to be treated as valid. This affects TLS connections where certificate revocation checking is required. The vulnerability requires no user interaction and affects both inbound and outbound TLS connections; fixes are available in versions 11.0.26, 10.1.59, and 9.0.122.

## Affected products

- Apache Tomcat 8.5.0 through 8.5.100, 9.0.0-M1 through 9.0.121, 10.1.0-M1 through 10.1.58, 11.0.0-M1 through 11.0.25

## Timeline

- 2026-09-23: disclosed
- 2026-09-23: patched: Fixed in versions 11.0.26, 10.1.59, 9.0.122

## References

- [https://lists.apache.org/thread/r0dj3h1pbn4wv96fhsfrnz3t6874t6do](https://lists.apache.org/thread/r0dj3h1pbn4wv96fhsfrnz3t6874t6do)
- [http://www.openwall.com/lists/oss-security/2026/09/23/19](http://www.openwall.com/lists/oss-security/2026/09/23/19)

## Related threats

- [Apache Tomcat Jakarta Security credential handler bypass](https://junglewise.ai/threats/cve-2026-111248-the-jakarta-security-identity-store-backed-by-the-tomcat-user)
- [Apache Tomcat incomplete cleanup in TLS 1.3 connections](https://junglewise.ai/threats/cve-2026-93446-incomplete-cleanup-vulnerability-in-apache-tomcat-could-cause-tls)
- [Apache Tomcat HTTP trailer information leak between requests](https://junglewise.ai/threats/cve-2026-88041-incomplete-cleanup-vulnerability-in-apache-tomcat-allowed-an)
- [Apache Tomcat TOCTOU race condition in APR/Native connector](https://junglewise.ai/threats/cve-2026-80353-time-of-check-time-of-use-toctou-race-condition-vulnerability-in)
- [Apache Tomcat Execution After Redirect vulnerability](https://junglewise.ai/threats/cve-2026-74049-execution-after-redirect-ear-vulnerability-in-apache-tomcat-this)