CVE Intelligence
Analysis AI-assisted

CVE-2026-53434: Apache Tomcat CRL Configuration Flaw in FFM Connector (CWE-390)

Apache Tomcat is affected by a CWE-390 weakness (Detection of Error Condition Without Action) in the configuration of certificate revocation lists (CRLs) for an FFM-based connector. The record assigns a CVSS 3.1 base score of 9.1 (critical) and lists affected ranges in three release branches, with fixed versions 11.0.23, 10.1.56 and 9.0.119. No confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes a CWE-390 weakness in Apache Tomcat, reported as Detection of Error Condition Without Action, affecting the configuration of certificate revocation lists (CRLs) for a connector based on FFM. The Apache Tomcat security mailing list thread is the primary vendor source in the record.

Impact

  • The sources consulted do not describe the practical consequences of the flaw in detail.
  • The CVSS 3.1 vector in the record (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) describes a network-reachable issue requiring no privileges or user interaction, with high confidentiality and integrity impact. This reading is an inference from the vector.
  • Because the weakness concerns error detection in CRL handling, a plausible effect is that revocation errors are not acted upon as expected. This is an inference, not a confirmed outcome.

Affected products and versions

  • Apache Tomcat from 11.0.0-M1 through 11.0.22
  • Apache Tomcat from 10.1.0-M7 through 10.1.55
  • Apache Tomcat from 9.0.83 through 9.0.118

The advisory text recommends upgrading to 11.0.23, 10.1.56 or 9.0.119, one for each branch.

Exploitation status

The record shows that this CVE is not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00586 with a percentile of 0.46552, as recorded.

Remediation and mitigation

  • Upgrade Apache Tomcat to 11.0.23, 10.1.56 or 9.0.119, matching the installed branch.
  • Prioritize instances that use the FFM-based connector with CRL configuration, since that is the feature named in the record.
  • If an upgrade cannot be applied immediately, review network exposure of the affected connector and confirm the CRL settings against your certificate policy. Specific workaround steps are not provided in the sources consulted.

Detection guidance

  • Inventory Apache Tomcat installations and their exact versions, including embedded deployments.
  • Check whether CRL settings are used on the affected connector type.
  • Review application and server logs for certificate validation errors or revocation checks that did not produce the expected result, and investigate anomalies.

Limitations of the available information

  • The record has no title, no fixes array and no CWE name, so the CWE label comes only from its identifier.
  • Only the vendor-style description and the CVSS data from the record are available; no exploit details or technical root cause are given.
  • It is not stated whether default configurations are affected or only explicitly configured CRL setups.
  • The record shows a CVSS score from a CNA-provided source; no other scoring provider is listed.
  • The EPSS date in the record is later than the publication date, so its timing should be interpreted with care.

Sources consulted: NVD entry, CVE Record, Apache mailing list thread, Openwall oss-security post.

Frequently asked questions

Which Apache Tomcat versions are fixed for CVE-2026-53434?

The advisory text recommends upgrading to 11.0.23 for the 11.0 branch, 10.1.56 for the 10.1 branch, or 9.0.119 for the 9.0 branch.

Is CVE-2026-53434 known to be exploited?

The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.