Copyright © 2012 Red Hat, Inc. All rights reserved. Low 2026-06-29T20:41:06 tomcat: Apache Tomcat: Error condition not handled when configuring CRLs 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CWE-390

Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.

A flaw was found in Apache Tomcat. When configuring Certificate Revocation Lists (CRLs) for a FFM (presumably a specific type of connector), the system fails to detect and act upon an error condition. This oversight could lead to unexpected behavior or a security bypass, as the intended security controls might not be properly enforced.

A flaw was found in Apache Tomcat. When using the FFM-based connector with CRL-based certificate revocation checking, an error in CRL data processing is not handled correctly, potentially allowing revoked certificates to be accepted. This only affects Tomcat 10.1.0-M7+ and 11.x using the FFM connector (Java 22+ Foreign Function & Memory API) with CRL configuration — an extremely narrow set of conditions not present in standard Red Hat deployments. This vulnerability only affects Tomcat deployments using the FFM-based connector (requires Java 22+) with CRL-based certificate revocation checking. Deployments using the standard NIO/NIO2 connectors or not using CRL checking are not affected. Red Hat Hardened Images 2026-06-24T00:00:00Z RHSA-2026:29203 tomcat10-main-10.1.56-1.hum1 Red Hat Hardened Images 2026-06-29T00:00:00Z RHSA-2026:32960 tomcat11-main-11.0.23-0.1.hum1 Red Hat Enterprise Linux 10 Fix deferred tomcat Red Hat Enterprise Linux 10 Fix deferred tomcat9 Red Hat Enterprise Linux 6 Fix deferred tomcat6 Red Hat Enterprise Linux 7 Fix deferred tomcat Red Hat Enterprise Linux 8 Fix deferred pki-deps:10.6/pki-servlet-engine Red Hat Enterprise Linux 8 Fix deferred tomcat Red Hat Enterprise Linux 9 Fix deferred pki-servlet-engine Red Hat Enterprise Linux 9 Fix deferred tomcat Red Hat JBoss Web Server 5 Fix deferred jws5-tomcat Red Hat JBoss Web Server 6 Affected tomcat-coyote-ffm Red Hat JBoss Web Server 7 Affected tomcat-coyote-ffm https://www.cve.org/CVERecord?id=CVE-2026-53434 https://nvd.nist.gov/vuln/detail/CVE-2026-53434 https://lists.apache.org/thread/x510lbq0sfrd1qyo7q3r1mpllgpdcosk