Apache Tomcat util accepted misconfigured CRLs

org.apache.tomcat:tomcat-util (maven)

Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring Certificate Revocation List (CRLs) for a FFM based connector. If an FFM connector was configured with invalid CRLs, the invalid CRLs were ignored meaning invalid certificates could be accepted.

Fix it

org.apache.tomcat:tomcat-util maven

On 9.x?mvn versions:use-dep-version -Dincludes=org.apache.tomcat:tomcat-util -DdepVersion=9.0.119 -DforceVersion=true
On 10.x?mvn versions:use-dep-version -Dincludes=org.apache.tomcat:tomcat-util -DdepVersion=10.1.56 -DforceVersion=true
On 11.x?mvn versions:use-dep-version -Dincludes=org.apache.tomcat:tomcat-util -DdepVersion=11.0.23 -DforceVersion=true

First seen: 29 Jun 2026
Last update: 29 Jun 2026, 21:32 UTC
Fixed in: org.apache.tomcat:tomcat-util 11.0.23
org.apache.tomcat:tomcat-util 10.1.56
org.apache.tomcat:tomcat-util 9.0.119
Identifiers: CVE-2026-53434
Source: GitHub advisory
On the menu as: Java

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Apache Tomcat util accepted misconfigured CRLs
Severity: critical. Patch status: patched.
Affected: org.apache.tomcat:tomcat-util (maven)
Fixed in: org.apache.tomcat:tomcat-util 11.0.23, org.apache.tomcat:tomcat-util 10.1.56, org.apache.tomcat:tomcat-util 9.0.119
Ids: CVE-2026-53434

Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring Certificate Revocation List (CRLs) for a FFM based connector. If an FFM connector was configured with invalid CRLs, the invalid CRLs were ignored meaning invalid certificates could be accepted.

## Steps
1. Search the repo, its CI and infra config for org.apache.tomcat:tomcat-util (maven). If present, report the version in use and whether it's affected.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-53434") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: http://www.openwall.com/lists/oss-security/2026/06/29/22 https://github.com/advisories/GHSA-4x29-79gh-6v8q https://github.com/apache/tomcat/commit/7f8ecdbd930d8c5a7fae73aa0eec9124d919e2f5 https://lists.apache.org/thread/x510lbq0sfrd1qyo7q3r1mpllgpdcosk https://nvd.nist.gov/vuln/detail/CVE-2026-53434
https://pwned.coffee/i/apache-tomcat-util-accepted-misconfigured-crls-cve-2026-53434

Sources

Wrong fix version, or a source we missed? Send it back to chef@pwned.coffee with the source, and we'll correct it here.

Totalone very hot coffee