Staging Environment: Content and features may be unstable or change without notice.
Advisory details: gitlab / maven/org.apache.tomcat/tomcat-coyote-ffm/CVE-2026-53434
Advisory ID gitlab/maven/org.apache.tomcat/tomcat-coyote-ffm/CVE-2026-53434
Aliases CVE-2026-53434
GHSA-4x29-79gh-6v8q
Summary Apache Tomcat - Invalid CRL configuration doesn't trigger failure for FFM Connector Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. Invalid CRLs were ignored meaning invalid certificates could be accepted. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (3)
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-390 Detection of Error Condition Without Action
System Score Found at
cvssv3.1 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat/tomcat-coyote-ffm/CVE-2026-53434.yml
Reference id Reference type URL
https://github.com/apache/tomcat/commit/7f8ecdbd930d8c5a7fae73aa0eec9124d919e2f5
https://tomcat.apache.org/security-10.html
https://tomcat.apache.org/security-11.html
https://tomcat.apache.org/security-9.html
http://www.openwall.com/lists/oss-security/2026/06/29/22
CVE-2026-53434 https://nvd.nist.gov/vuln/detail/CVE-2026-53434
GHSA-4x29-79gh-6v8q https://github.com/advisories/GHSA-4x29-79gh-6v8q
x510lbq0sfrd1qyo7q3r1mpllgpdcosk Advisory https://lists.apache.org/thread/x510lbq0sfrd1qyo7q3r1mpllgpdcosk
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat/tomcat-coyote-ffm/CVE-2026-53434.yml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

There are no SSVC decisions available.