CVE-2026-53434: Apache Tomcat CRL Configuration Flaw

CVE-2026-53434 Overview

CVE-2026-53434 affects Apache Tomcat when Certificate Revocation Lists (CRLs) are configured for a Foreign Function & Memory (FFM) based connector. The flaw is classified as Detection of Error Condition Without Action [CWE-390], meaning Tomcat detects a failure state during CRL configuration but continues operating without enforcing the expected security check. As a result, revoked client certificates may be accepted during TLS mutual authentication.

Critical Impact
Client certificates that should be rejected due to CRL entries may be accepted, allowing attackers presenting revoked credentials to authenticate against Tomcat services exposed over the network.

Affected Products

Apache Tomcat 11.0.0-M1 through 11.0.22
Apache Tomcat 10.1.0-M7 through 10.1.55
Apache Tomcat 9.0.83 through 9.0.118

Discovery Timeline

2026-06-29 - CVE-2026-53434 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-53434

Vulnerability Analysis

Apache Tomcat supports TLS connectors backed by the Java Foreign Function & Memory (FFM) API, which bridges Java code to native OpenSSL routines. When administrators configure a Certificate Revocation List for such a connector, Tomcat is expected to validate incoming client certificates against the CRL during the TLS handshake. The vulnerable code path detects an error condition during CRL configuration but fails to act on it. The connector continues to serve traffic without applying revocation checks. This weakness maps to [CWE-390] Detection of Error Condition Without Action, a defect pattern in which software correctly identifies a failure yet proceeds as if the operation succeeded.

Root Cause

The root cause is missing error handling in the FFM connector CRL configuration logic. When CRL setup fails, the connector should either reject configuration or fail closed. Instead, the connector starts and accepts client certificates without enforcing revocation status. Deployments relying on CRL validation to reject compromised or decommissioned certificates lose that control silently.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker holding a client certificate that has been revoked but is otherwise well-formed can present it to a Tomcat instance using a misconfigured FFM connector. Because CRL enforcement is silently disabled, Tomcat completes mutual TLS and grants access as if the certificate were valid. Environments using client-certificate authentication for administrative interfaces, machine-to-machine APIs, or partner integrations are directly exposed.

No verified proof-of-concept code is publicly available. See the Apache Mailing List Thread and the OpenWall OSS-Security Update for advisory details.

Detection Methods for CVE-2026-53434

Indicators of Compromise

Successful client-certificate authenticated sessions in Tomcat access logs originating from certificates that appear in the configured CRL.
Absence of CRL validation errors or warnings in catalina.out after CRL configuration changes on FFM connectors.
TLS handshakes completing for client certificates issued by CAs whose revocation feeds have recent additions.

Detection Strategies

Audit server.xml for connectors using the FFM implementation with certificateRevocationListFile or equivalent CRL attributes and confirm CRL enforcement at runtime.
Perform active testing by presenting a known-revoked test certificate to the connector and verifying that the handshake is rejected.
Compare Tomcat versions in deployment inventories against fixed releases 11.0.23, 10.1.56, and 9.0.119.

Monitoring Recommendations

Alert on TLS client authentication events where the client certificate serial number matches entries in current CRLs.
Monitor Tomcat startup logs for silent failures in CRL loading and treat missing CRL confirmation messages as high-priority findings.
Track certificate issuance and revocation events from internal CAs and correlate with Tomcat authentication logs.

How to Mitigate CVE-2026-53434

Immediate Actions Required

Upgrade Apache Tomcat to 11.0.23, 10.1.56, or 9.0.119 depending on the deployed branch.
Inventory all Tomcat instances using FFM-based connectors and prioritize those exposing client-certificate authenticated endpoints.
Rotate or reissue client certificates for any environment where revoked certificates may have been used during the exposure window.

Patch Information

The Apache Tomcat project has released fixed versions 11.0.23, 10.1.56, and 9.0.119 that correctly enforce CRL configuration errors on FFM connectors. Refer to the Apache Mailing List Thread for the official advisory and release notes.

Workarounds

Switch affected connectors from the FFM implementation to the NIO or NIO2 implementation using the JSSE TLS stack until upgrades can be applied.
Disable client-certificate authentication on affected connectors if CRL enforcement cannot be validated.
Restrict network access to Tomcat listeners at the firewall or reverse proxy layer so that only trusted clients can initiate TLS handshakes.

bash

# Example: pin a Tomcat connector to the JSSE (NIO) implementation while patching
<Connector port="8443"
           protocol="org.apache.coyote.http11.Http11NioProtocol"
           SSLEnabled="true"
           scheme="https"
           secure="true"
           clientAuth="true"
           sslImplementationName="org.apache.tomcat.util.net.jsse.JSSEImplementation">
    <SSLHostConfig certificateVerification="required"
                   caCertificateFile="conf/ca-bundle.pem"
                   revocationEnabled="true"
                   certificateRevocationListFile="conf/revoked.crl">
        <Certificate certificateKeyFile="conf/server.key"
                     certificateFile="conf/server.crt"/>
    </SSLHostConfig>
</Connector>