CVE-2026-53434

Analyzed Analyzed - Analysis Complete

Error Condition Without Action in Apache Tomcat

Publication date: 2026-06-29

Last updated on: 2026-07-02

Assigner: Apache Software Foundation

Description

Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-29

Last Modified

2026-07-02

Generated

2026-07-20

AI Q&A

2026-06-30

EPSS Evaluated

2026-07-18

NVD

CVE-2026-53434

Affected Vendors & Products

Vendor	Product	Version / Range
apache	tomcat	From 10.1.0 (inc) to 10.1.56 (exc)
apache	tomcat	From 11.0.0 (inc) to 11.0.23 (exc)
apache	tomcat	From 9.0.83 (inc) to 9.0.119 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-390	The product detects a specific error, but takes no actions to handle the error.

Attack-Flow Graph

Executive Summary

This vulnerability is a Detection of Error Condition Without Action issue in Apache Tomcat. It occurs when configuring Certificate Revocation Lists (CRLs) for a FFM based connector. Essentially, the system detects an error condition but does not take any corrective or mitigating action.

Impact Analysis

Because the system detects an error condition without taking action, it may fail to properly handle revoked certificates when using CRLs. This could potentially allow revoked or invalid certificates to be accepted, leading to security risks such as unauthorized access or man-in-the-middle attacks.

Compliance Impact

The vulnerability in Apache Tomcat involves a failure to trigger an error when an invalid Certificate Revocation List (CRL) is configured for the FFM connector. This could allow the system to continue operating despite potentially revoked or invalid certificates.

Such a failure in certificate validation may increase security risks by allowing unauthorized or compromised certificates to be accepted, which could lead to unauthorized access or data exposure.

While the provided information does not explicitly mention compliance with standards like GDPR or HIPAA, improper certificate validation and potential unauthorized access could negatively impact compliance with these regulations, which require strong security controls to protect sensitive data.

Therefore, this vulnerability could indirectly affect compliance by weakening the security posture required under such regulations.

Mitigation Strategies

Users are recommended to upgrade Apache Tomcat to version 11.0.23, 10.1.56, or 9.0.119, which fixes the issue.

Hi! I’m here to help you understand CVE-2026-53434. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70