CVE-2026-53434

A flaw was found in Apache Tomcat. When configuring Certificate Revocation Lists (CRLs) for a FFM (presumably a specific type of connector), the system fails to detect and act upon an error condition. This oversight could lead to unexpected behavior or a security bypass, as the intended security controls might not be properly enforced.

A flaw in Apache Tomcat's FFM-based connector causes errors loading configured Certificate Revocation Lists (CRLs) to be ignored, which could allow certificates that should be rejected to be accepted. Upstream affected versions are 9.0.83 through 9.0.118, 10.1.0-M7 through 10.1.55, and 11.0.0-M1 through 11.0.22. The affected path requires the FFM connector and CRL-based certificate revocation checking with invalid CRL data.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

This vulnerability only affects Tomcat deployments using the FFM-based connector (requires Java 22+) with CRL-based certificate revocation checking. Deployments using the standard NIO/NIO2 connectors or not using CRL checking are not affected.