Error Condition Without Action in Apache Tomcat

Publication date: 2026-06-29

Last updated on: 2026-06-29

Assigner: Apache Software Foundation

Description

Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-29

Last Modified

2026-06-29

Generated

2026-06-30

AI Q&A

2026-06-30

EPSS Evaluated

N/A

NVD

CVE-2026-53434

Affected Vendors & Products

Vendor	Product	Version / Range
apache	tomcat	From 11.0.0-m1 (inc) to 11.0.22 (inc)
apache	tomcat	From 10.1.0-m7 (inc) to 10.1.55 (inc)
apache	tomcat	From 9.0.83 (inc) to 9.0.118 (inc)
apache	tomcat	11.0.23
apache	tomcat	10.1.56
apache	tomcat	9.0.119

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-390	The product detects a specific error, but takes no actions to handle the error.

Attack-Flow Graph

Executive Summary

This vulnerability is a Detection of Error Condition Without Action issue in Apache Tomcat. It occurs when configuring Certificate Revocation Lists (CRLs) for a FFM based connector. Essentially, the system detects an error condition but does not take any corrective or mitigating action.

Impact Analysis

Because the system detects an error condition without taking action, it may fail to properly handle revoked certificates when using CRLs. This could potentially allow revoked or invalid certificates to be accepted, leading to security risks such as unauthorized access or man-in-the-middle attacks.

Mitigation Strategies

Users are recommended to upgrade Apache Tomcat to version 11.0.23, 10.1.56, or 9.0.119, which fixes the issue.

Hi! I’m here to help you understand CVE-2026-53434. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70