https://seclists.org/oss-sec/2026/q3/898: CVE-2026-73581: Apache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignoCRLs when certificate uses a keysto

Q: Which deployments are in scope?

The issue applies to deployments using the OpenSSL or OpenSSL-FFM TLS implementation in the certificate/keystore scenario described. The supplied information does not establish whether other TLS implementations are affected.

Q: Which Tomcat release lines are listed as affected?

Affected ranges are listed as 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, 9.0.0.M1 through 9.0.121, and 8.5.0 through 8.50.100.

Q: Is the Tomcat 8.5.0 boundary clear from the supplied advisory data?

No. The affected-version list includes 8.5.0, while another supplied line says Tomcat through 8.5.0 is unaffected. Confirm the precise 8.5.x boundary with the upstream advisory before using that statement for remediation decisions.

Published Sep 23, 2026

Updated

Affected Software

1 affected component

Apache Tomcat>=11.0.0-M1<=11.0.25, >=10.1.0-M1<=10.1.59, >=9.0.0.M1<=9.0.121, >=8.5.0<=8.50.100

Frequently Asked Questions

Which deployments are in scope?

The issue applies to deployments using the OpenSSL or OpenSSL-FFM TLS implementation in the certificate/keystore scenario described. The supplied information does not establish whether other TLS implementations are affected.

Which Tomcat release lines are listed as affected?

Affected ranges are listed as 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, 9.0.0.M1 through 9.0.121, and 8.5.0 through 8.50.100.

Is the Tomcat 8.5.0 boundary clear from the supplied advisory data?

No. The affected-version list includes 8.5.0, while another supplied line says Tomcat through 8.5.0 is unaffected. Confirm the precise 8.5.x boundary with the upstream advisory before using that statement for remediation decisions.

https://seclists.org/oss-sec/2026/q3/898: CVE-2026-73581: Apache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignoCRLs when certificate uses a keysto

Affected Software

Frequently Asked Questions

Which deployments are in scope?

Which Tomcat release lines are listed as affected?

Is the Tomcat 8.5.0 boundary clear from the supplied advisory data?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are in scope?

Which Tomcat release lines are listed as affected?

Is the Tomcat 8.5.0 boundary clear from the supplied advisory data?