Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-06-30 | 2 | Disclosure2 |
| 2026-07-02 | 1 | Disclosure1 |
Apache Tomcatの脆弱性(Important: CVE-2026-55957, Moderate: CVE-2026-55956, Low: CVE-2026-55955, CVE-2026-55276, CVE-2026-53434, CVE-2026-53404, CVE-2026-50229) #sios_tech #security #vulnerability #セキュリティ #脆弱性 #linux #tomcat #mod_jk #apache https://security.sios.jp/vulnerability/tomcat-security-vulnerability-20260630/
Post summary
An announcement listing multiple Apache Tomcat CVEs with severity ratings and a link to further details.
🚨 CRITICAL: CVE-2026-53434 (CVSS 9.1) in Apache Tomcat Affects versions 9.0.83-9.0.118, 10.1.0-M7-10.1.55, 11.0.0-M1-11.0.22 Upgrade immediately to 9.0.119, 10.1.56, or 11.0.23 #CVE #Vulnerability #PatchNow #ThreatIntel https://t.co/UF8moKOKap
Post summary
The tweet announces the critical CVE-2026-53434 in Apache Tomcat and urges immediate upgrade to the patched releases.
🚨 CRITICAL - Tomcat FFM Connector CRL Validation Bypass (CVE-2026-53434) Apache Tomcat has a CWE-390 flaw in its FFM-based TLS connector when certificate revocation lists (CRLs) are configured, where an error condition is detected but not properly acted upon. The root cause is improper error handling (detection of an error condition without enforcing failure), leading to incorrect revocation checking behavior. An attacker can exploit this over the network during TLS client-certificate authentication by presenting a certificate that should be rejected, relying on CRL processing errors being ignored or mishandled. Impact is authentication bypass and unauthorized access to CRL-protected endpoints, potentially enabling access to restricted applications and sensitive data. 👉 Affected: Apache Tomcat 11.0.0-M1–11.0.22, 10.1.0-M7–10.1.55, 9.0.83–9.0.118 | Upgrade to 11.0.23 / 10.1.56 / 9.0.119
Post summary
The post announces CVE-2026-53434, a CRL validation bypass flaw in Apache Tomcat’s FFM connector, details its technical aspects, and advises upgrading to patched versions.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | apache | tomcat | - | - | - |