REDHAT-BUG-2539356: Medium severity Apache Tomcat vulnerability

Q: Which deployments are exposed to this issue?

Deployments using Apache Tomcat's OpenSSL or OpenSSL-FFM TLS implementation are affected when certificates use a keystore. The affected ranges include Tomcat 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.58, and 9.0.0-M1 through 9.0.121; Tomcat 8.5.0 through 8.5.100 is also known to be affected.

Q: What condition is required for exploitation?

The issue applies when the OpenSSL or OpenSSL-FFM TLS implementation is used with a certificate that uses a keystore. Under those conditions, certificate revocation lists are ignored.

Q: Does this affect unsupported Tomcat releases?

Yes. Tomcat 8.5.0 through 8.5.100 was end of life when the issue was created and is known to be affected. Other unsupported versions may also be affected.

Q: What versions resolve the issue?

Upgrade to Apache Tomcat 11.0.26, 10.1.59, or 9.0.122. These versions fix the CRL handling issue.

Published Sep 23, 2026

Updated

Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.58, from 9.0.0-M1 through 9.0.121.

The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected.

Users are recommended to upgrade to version 11.0.26, 10.1.59, 9.0.122, which fixes the issue.

Affected Software

1 affected component

Apache Tomcat>=11.0.0-M1<=11.0.25, >=10.1.0-M1<=10.1.58, >=9.0.0-M1<=9.0.121, >=8.5.0<=8.5.100

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Tomcat to a version that resolves this vulnerability.
Fixed in 11.0.26
Upgrade
Upgrade Apache Tomcat to a version that resolves this vulnerability.
Fixed in 10.1.59
Upgrade
Upgrade Apache Tomcat to a version that resolves this vulnerability.
Fixed in 9.0.122

Event History

Sep 23, 2026

Data Sourced

via Red Hat·11:33 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using Apache Tomcat's OpenSSL or OpenSSL-FFM TLS implementation are affected when certificates use a keystore. The affected ranges include Tomcat 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.58, and 9.0.0-M1 through 9.0.121; Tomcat 8.5.0 through 8.5.100 is also known to be affected.

What condition is required for exploitation?

The issue applies when the OpenSSL or OpenSSL-FFM TLS implementation is used with a certificate that uses a keystore. Under those conditions, certificate revocation lists are ignored.

Does this affect unsupported Tomcat releases?

Yes. Tomcat 8.5.0 through 8.5.100 was end of life when the issue was created and is known to be affected. Other unsupported versions may also be affected.

What versions resolve the issue?

Upgrade to Apache Tomcat 11.0.26, 10.1.59, or 9.0.122. These versions fix the CRL handling issue.

REDHAT-BUG-2539356: Medium severity Apache Tomcat vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What condition is required for exploitation?

Does this affect unsupported Tomcat releases?

What versions resolve the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What condition is required for exploitation?

Does this affect unsupported Tomcat releases?

What versions resolve the issue?