CVE-2026-53434

Critical · CVSS 9.1

Apache Tomcat — Detection of Error Condition Without Action (CWE-390) in CRL handling for FFM-based connector

CVSS: 9.1; nvd
EPSS: —
KEV: No
Class: other; CWE-390

Description

Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.

Search profile — drives PoC discovery

Symbols CRLFFMFFMConnectorconfigureCRLCRLExceptionX509CRLSSLHostConfigCertificateRevocationListFFMbasedConnectorOpenSSLConf

Keywords CVE-2026-53434Apache TomcatCRLFFM connectorCWE-390certificate revocation listerror condition without actionTomcat TLSTomcat SSL CRL bypassTomcat FFM CRL misconfiguration

Versions: 11.0.0-M1 through 11.0.22, 10.1.0-M7 through 10.1.55, 9.0.83 through 9.0.118

References

Status: enriched · ingested 2026-07-03T00:00:43.000Z · profiled 2026-07-03T00:30:43.000Z