Apache Tomcat util accepted misconfigured CRLs

緊急 9.1CVE-2026-53434 · BIT-tomcat-2026-53434 · GHSA-4x29-79gh-6v8q · 29/06/2026 公開 · 25/10/2026 更新

要点

CVE-2026-53434 は org.apache.tomcat:tomcat-util, tomcat (apache) に影響する深刻度「緊急」 (CVSS 9.1) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.59%（全脆弱性の 48.0% より高い）。
対処：10.1.56, 11.0.23, 9.0.119 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.apache.tomcat:tomcat-util Maven	`≥ 10.1.0-M7, < 10.1.56≥ 11.0.0-M1, < 11.0.23≥ 9.0.83, < 9.0.119`	`10.1.5611.0.239.0.119`
tomcat apache	`≥ 10.1.0, < 10.1.56≥ 11.0.0, < 11.0.23≥ 9.0.83, < 9.0.119`	`10.1.5611.0.239.0.119`

概要

Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring Certificate Revocation List (CRLs) for a FFM based connector. If an FFM connector was configured with invalid CRLs, the invalid CRLs were ignored meaning invalid certificates could be accepted.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.

NVD の説明

Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.