CVE-2026-73581

A flaw was found in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM Transport Layer Security (TLS) implementations fail to properly check Certificate Revocation Lists (CRLs) when a certificate uses a keystore. This oversight could allow an attacker to use a revoked certificate, potentially leading to unauthorized access or impersonation of a legitimate server or client.

This vulnerability is rated as Moderate impact for Red Hat products because successful exploitation requires a specific configuration combining OpenSSL-based TLS with keystores while relying on Certificate Revocation List (CRL) validation. Typical deployments using standard Java JSSE providers or configurations without CRL verification are not affected by this behavior. Furthermore, exploitation is limited to scenarios where an attacker already possesses a legitimately issued certificate that has been revoked by the issuing authority.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when/if they become available.