Description
Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore.



This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0-M1 through 9.0.121.



The following versions were EOL at the time the CVE was created but are
known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected.



Users are recommended to upgrade to version 11.0.26, 10.1.59, 9.0.122, which fixes the issue.
Published: 2026-09-23
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Potential exploitation of revoked certificates leading to unauthorized access or data interception
Action: Immediate Patch
AI Analysis

Impact

Apache Tomcat’s OpenSSL and OpenSSL-FFM TLS implementations do not perform Certificate Revocation List checks for certificates obtained from a keystore, enabling the reuse of revoked certificates. This flaw permits attackers to conduct man‑in‑the‑middle or unauthorized session establishment, thereby compromising the confidentiality and integrity of TLS connections.

Affected Systems

The vulnerability affects Apache Tomcat versions 8.5.0 through 8.5.100, 9.0.0-M1 through 9.0.121, 10.1.0-M1 through 10.1.59, and 11.0.0-M1 through 11.0.25, including all EOL releases listed. Unsupported versions beyond those ranges may also be affected.

Risk and Exploitability

The CVSS score is 6.5, indicating a medium severity level and reflecting the significance of ignoring revocation checks which can allow unauthorized connections. The EPSS score is <1%, indicating a very low but non‑zero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely exploitation path involves network‑connected servers running affected Tomcat releases with TLS enabled and certificates sourced from a keystore, making the attack vector remote over the internet or internal network.

Generated by OpenCVE AI on October 1, 2026 at 21:34 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor‑published update to the Apache Tomcat installation, updating to version 11.0.26, 10.1.59, or 9.0.122, which includes the CRL‑checking fix.
  • Reconfigure Tomcat to avoid using a keystore for certificates – for example, move certificates to an external JKS or PKCS#12 store or disable keystore‑based certificate usage.
  • Restart Tomcat to apply the patch and configuration changes, then verify that revoked certificates are properly rejected during TLS handshakes.

Generated by OpenCVE AI on October 1, 2026 at 21:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 30 Sep 2026 15:15:00 +0000

Type Values Removed Values Added
Description Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.58, from 9.0.0-M1 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.59, 9.0.122, which fixes the issue. Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0-M1 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.59, 9.0.122, which fixes the issue.

Tue, 29 Sep 2026 13:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat
Redhat hummingbird
Weaknesses CWE-295
CPEs cpe:/a:redhat:hummingbird:1
Vendors & Products Redhat
Redhat hummingbird
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 23 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
References

Wed, 23 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 23 Sep 2026 14:00:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache tomcat
Vendors & Products Apache
Apache tomcat

Wed, 23 Sep 2026 11:45:00 +0000

Type Values Removed Values Added
Description Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.58, from 9.0.0-M1 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.59, 9.0.122, which fixes the issue.
Title Apache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore
Weaknesses CWE-299
References

Subscriptions

Apache Tomcat
Redhat Hummingbird
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-09-30T14:53:50.292Z

Reserved: 2026-08-13T07:31:17.111Z

Link: CVE-2026-73581

cve-icon Vulnrichment

Updated: 2026-09-23T18:10:39.638Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-23T12:17:06.287

Modified: 2026-09-30T15:22:34.000

Link: CVE-2026-73581

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-23T11:08:53Z

Links: CVE-2026-73581 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T21:45:06Z

Weaknesses
  • CWE-295

    Improper Certificate Validation

  • CWE-299

    Improper Check for Certificate Revocation