Loading vulnerability…
Invalid CRL Configuration Security Bypass in Apache Tomcat FFM Connectors
CVE-2026-53434 is an error-handling vulnerability in Apache Tomcat's FFM-based connector implementation. An invalid certificate revocation list (CRL) configuration does not trigger the expected failure, potentially allowing the connector to operate without enforcing the intended certificate revocation checks. Certificates that should be rejected may consequently be accepted, undermining certificate-based authentication. Affected releases are 11.0.0-M1 through 11.0.22, 10.1.0-M7 through 10.1.55, and 9.0.83 through 9.0.118.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Failure to enforce intended certificate revocation checks can permit security restrictions based on certificate validity to be bypassed. Acceptance of certificates that should have been rejected can undermine authentication and expose protected communications or resources to unauthorized access. The CVE-specific CVSS assessment indicates high confidentiality and integrity impacts, with no availability impact.
If you can’t patch tonight, do this now.
Validate CRLs configured for FFM-based connectors and correct invalid CRL configurations. Verify that the intended certificate revocation checks are enforced rather than relying on successful connector initialization as evidence of a valid configuration. No separate temporary workaround is specified.
Patch, then assume compromise.
Upgrade Apache Tomcat to 11.0.23, 10.1.56, or 9.0.119, or a later fixed release in the corresponding branch. For ExtremeControl for Site Engine deployments affected by this vulnerability, upgrade to version 26.8.10 or later. Products bundling Tomcat should receive the applicable vendor-supported security update.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
34 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.