{"schema":"threatline.record/2","record":{"id":"CVE-2026-53434","aliases":["GHSA-4x29-79gh-6v8q"],"summary":"Apache Tomcat util accepted misconfigured CRLs","details":"Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring Certificate Revocation List (CRLs) for a FFM based connector. If an FFM connector was configured with invalid CRLs, the invalid CRLs were ignored meaning invalid certificates could be accepted.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118.\n\nUsers are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.","categories":["Web servers"],"product":"org.apache.tomcat:tomcat-util","vendor":"Apache Software Foundation","ecosystem":"maven","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-4x29-79gh-6v8q","source_modified_at":"2026-10-23T21:42:44Z","fetched_at":"2026-10-23T21:47:51.402276Z","package":{"ecosystem":"maven","name":"org.apache.tomcat:tomcat-util"},"range":">= 11.0.0-M1, <= 11.0.22"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-4x29-79gh-6v8q","source_modified_at":"2026-10-23T21:42:44Z","fetched_at":"2026-10-23T21:47:51.402276Z","package":{"ecosystem":"maven","name":"org.apache.tomcat:tomcat-util"},"range":">= 10.1.0-M7, <= 10.1.55"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-4x29-79gh-6v8q","source_modified_at":"2026-10-23T21:42:44Z","fetched_at":"2026-10-23T21:47:51.402276Z","package":{"ecosystem":"maven","name":"org.apache.tomcat:tomcat-util"},"range":">= 9.0.83, <= 9.0.118"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-53434","source_modified_at":"2026-06-30T12:28:36.391Z","fetched_at":"2026-10-23T21:47:51.402276Z","product":"Apache Tomcat","vendor":"Apache Software Foundation","versions":[{"lessThanOrEqual":"11.0.22","status":"affected","version":"11.0.0-M1","versionType":"semver"},{"lessThanOrEqual":"10.1.55","status":"affected","version":"10.1.0-M7","versionType":"semver"},{"lessThanOrEqual":"9.0.118","status":"affected","version":"9.0.83","versionType":"semver"},{"lessThanOrEqual":"9.0.82","status":"unaffected","version":"0","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-4x29-79gh-6v8q","source_modified_at":"2026-10-23T21:42:44Z","fetched_at":"2026-10-23T21:47:51.402276Z","package":{"ecosystem":"maven","name":"org.apache.tomcat:tomcat-util"},"version":"11.0.23"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-4x29-79gh-6v8q","source_modified_at":"2026-10-23T21:42:44Z","fetched_at":"2026-10-23T21:47:51.402276Z","package":{"ecosystem":"maven","name":"org.apache.tomcat:tomcat-util"},"version":"10.1.56"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-4x29-79gh-6v8q","source_modified_at":"2026-10-23T21:42:44Z","fetched_at":"2026-10-23T21:47:51.402276Z","package":{"ecosystem":"maven","name":"org.apache.tomcat:tomcat-util"},"version":"9.0.119"}],"cvss":9.1,"severity":"Critical","kev":{"listed":false},"epss":{"probability":0.00586,"percentile":0.47311,"score_date":"2026-10-23"},"published_at":"2026-06-29T20:41:06.948Z","modified_at":"2026-10-23T21:42:44Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-4x29-79gh-6v8q","fetched_at":"2026-10-23T21:47:51.402276Z","source_modified_at":"2026-10-23T21:42:44Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-53434","fetched_at":"2026-10-23T21:47:51.402276Z","source_modified_at":"2026-06-30T12:28:36.391Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-53434","fetched_at":"2026-10-23T21:47:51.402276Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","EPSS"],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53434","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://lists.apache.org/thread/x510lbq0sfrd1qyo7q3r1mpllgpdcosk","tags":["vendor-advisory"]},{"url":"https://github.com/apache/tomcat/commit/7f8ecdbd930d8c5a7fae73aa0eec9124d919e2f5","source":"GitHub Advisory Database"},{"url":"https://github.com/apache/tomcat/commit/c48ac39c27f4494f8c96b9d56a487253e362d276","source":"GitHub Advisory Database"},{"url":"https://github.com/apache/tomcat/commit/feec60d6099727db6f911534f6a0f6926ebab070","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-4x29-79gh-6v8q","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"total","assessed_at":"2026-06-30T12:28:14.286092Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-23T21:42:44Z","content_hash":"e9af606c9287b4297d4e0bbcd93dcce0d89a8509920aae7d6e607fca821ee0d8"}}