CVE-2026-53434

Certificate revocation lists (CRLs) are like “do not trust” lists for digital certificates. This bug means Tomcat might accept a broken or invalid CRL for an FFM-based setup, instead of stopping and warning you, which can leave your certificate checks weaker than intended—potentially letting attackers use untrusted or revoked certificates to gain access.

This matters if you run Apache Tomcat in versions 9.0.83–9.0.118, 10.1.0-M7–10.1.55, or 11.0.0-M1–11.0.22 and you use CRL configuration with an FFM-based connector. It is reachable over the network and does not require authentication or user interaction to attempt. The risk is only relevant when the CRL+FFM connector configuration is actually in use.

Treat this as urgent enough to schedule an upgrade soon: the vulnerability is highly sensitive to certificate trust, and attackers can potentially exploit it via the network without needing a login. However, there is no public exploit code on record, and no KEV listing was provided, so this is not an “instant outbreak” situation. With an AMBER verdict, prioritize patching over the next maintenance window and immediately if your Tomcat uses CRL with the FFM connector.

Confirm whether you’re exposed

1. Check your Tomcat version on each server running Apache Tomcat (look for whether it falls in one of these affected ranges):
   • 11.0.0-M1 through 11.0.22
   • 10.1.0-M7 through 10.1.55
   • 9.0.83 through 9.0.118
2. Confirm configuration scope:
   • Determine whether you configure CRLs in Tomcat for an FFM-based connector.
   • This issue is specifically about “CRL configuration used with an FFM-based connector,” so standard HTTPS setups without that configuration are not the target.

Upgrade to the fixed version

• Fixed for 9.0 branch: upgrade to Apache Tomcat 9.0.119.
• If you’re on the other affected branches, upgrade to the corresponding fixed versions noted by the vendor remediation guidance (11.0/10.1 lines are fixed as well, per the release information).

Upgrade notes / breaking-change risk

• This is a Tomcat security fix; follow your normal upgrade procedure (test in staging if you have one). Keep an eye on any TLS/connector configuration changes you make during the process.

If you cannot patch immediately (temporary workaround)

• The core risk exists when invalid CRLs are accepted without triggering failure. As a temporary step until you upgrade:
  • Validate your CRL inputs (ensure the CRL files are correct, current, and well-formed).
  • If your environment allows it, consider temporarily removing or disabling the CRL usage for the FFM connector until you can apply the fixed Tomcat version (this reduces the chance of the invalid-CRL path being accepted).

What to monitor after patching

• Verify Tomcat is running the upgraded version.
• Re-check that your FFM connector and CRL configuration behave as expected (especially error handling when CRL data is intentionally invalid in a test environment).

Severity is indicated as critical in the provided scoring, and the practical exposure depends on using CRL with an FFM-based connector. The weakness is a “detection of error condition without action” problem (CWE-390): when the CRL is invalid, Tomcat does not trigger the expected failure behavior for the FFM connector. The issue is network-reachable and requires no authentication or user interaction per the findings.

Exploitation status: no KEV listing was provided, and there is no public exploit code on record. This suggests exploitation is not widely documented, but the configuration-dependent trust-check bypass makes patching important for affected setups.

EPSS was provided as a low predicted likelihood and flat trend; public-facing scoring does not override the configuration risk. The vendor has fixed the issue by correcting behavior in the affected branches, with 9.0.119 called out explicitly as a fixed version.