CVE-2026-53434: Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector
Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118.
Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 11.0.23 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 10.1.56 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 9.0.119
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53434?
CVE-2026-53434 has a risk rating of 30, indicating a significant security issue.
How does CVE-2026-53434 affect Apache Tomcat?
CVE-2026-53434 affects Apache Tomcat by failing to trigger an error condition for invalid CRL configurations in FFM connectors.
How do I fix CVE-2026-53434?
To fix CVE-2026-53434, users should upgrade to Apache Tomcat version 11.0.23 or later.
Which versions of Apache Tomcat are vulnerable to CVE-2026-53434?
CVE-2026-53434 impacts Apache Tomcat versions from 11.0.0-M1 through 11.0.22, 10.1.0-M7 through 10.1.55, and 9.0.83 through 9.0.118.
What is the impact of CVE-2026-53434 on security?
The impact of CVE-2026-53434 could lead to unmonitored failure conditions, potentially compromising the system's security.