OESA-2026-4322 tomcat security update

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Security Fixes: Improper Check for Certificate...

tomcat: Apache Tomcat: Error condition not handled when configuring CRLs

A flaw was found in Apache Tomcat. When configuring Certificate Revocation Lists CRLs for a FFM presumably a specific type of connector, the system fails to detect and act upon an error condition. This oversight could lead to unexpected behavior or a security bypass, as the intended security...

BIT-TOMCAT-2026-73581 Apache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore

Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from 11.0.0 through 11.0.25, from 10.1.0 through 10.1.59, from 9.0.0 through 9.0.121. The...

PT-2026-105204

Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from 11.0.0 through 11.0.25, from 10.1.0 through 10.1.59, from 9.0.0 through 9.0.121. The...

CVE-2026-73581

A flaw was found in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM Transport Layer Security TLS implementations fail to properly check Certificate Revocation Lists CRLs when a certificate uses a keystore. This oversight could allow an attacker to use a revoked certificate, potentially leading to...

SUSE CVE-2026-73581

Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0-M1 through...

Linux Distros Unpatched Vulnerability : CVE-2026-73581

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses...

DEBIAN-CVE-2026-73581

Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0-M1 through...

CVE-2026-73581

Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0-M1 through...

CVE-2026-73581

Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.58, from 9.0.0-M1 through...

UBUNTU-CVE-2026-73581

Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.58, from 9.0.0-M1 through...

com.github.psi-probe:psi-probe-core (5.4.0), com.github.psi-probe:psi-probe-tomcat10 (5.4.0) +41 more potentially affected by CVE-2026-86350 via org.apache.tomcat:tomcat-coyote (>=10.1.55, <=10.1.59)

org.apache.tomcat:tomcat-coyote MAVEN version =10.1.55, =3.5.0, =10.1.55, =10.1.55, =10.1.55, =10.1.55, =10.1.59 - org.apache.tomee.bom:tomee-webprofile 10.2.0 - org.apache.tomee.maven:tomee-embedded-maven-plugin 10.2.0 - org.apache.tomee:apache-tomee 10.2.0 -...

CVE-2026-86248 Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled

CLIENTCERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from 10.1.22 through 10.1.59, from 9.0.92 through 9.0.121. Users are recommended to upgrade to versi...

CVE-2026-86248 Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled

CLIENTCERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from 10.1.22 through 10.1.59, from 9.0.92 through 9.0.121. Users are recommended to upgrade to versi...

org.apache.tomee.bom:tomee-microprofile (>=10.0.0-m3, <=10.0.0), org.apache.tomee.bom:tomee-plume (>=10.0.0-m3, <=10.0.0) +2 more potentially affected by CVE-2026-86248 via org.apache.tomcat:tomcat-coyote-ffm (>=10.1.30, <=10.1.57)

org.apache.tomcat:tomcat-coyote-ffm MAVEN version =10.1.30, =10.0.0-m3, =10.0.0-m3, =10.0.0-m3, =10.0.0-m3, =10.2.0 Source cves: CVE-2026-86248 Source advisory: MEND:CVE-2026-86248...

org.apache.tomee.bom:tomee-webprofile (11.0.0-m1) potentially affected by CVE-2026-86248 via org.apache.tomcat:tomcat-coyote-ffm (11.0.22)

org.apache.tomcat:tomcat-coyote-ffm MAVEN version 11.0.22 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat:tomcat-coyote-ffm and may be impacted: - org.apache.tomee.bom:tomee-webprofile 11.0.0-m1 Source cves: CVE-2026-86248 Source...

org.apache.tomee.bom:tomee-microprofile (>=10.0.0-m3, <=10.0.0), org.apache.tomee.bom:tomee-plume (>=10.0.0-m3, <=10.0.0) +2 more potentially affected by CVE-2026-73581 via org.apache.tomcat:tomcat-coyote-ffm (>=10.1.30, <=10.1.57)

org.apache.tomcat:tomcat-coyote-ffm MAVEN version =10.1.30, =10.0.0-m3, =10.0.0-m3, =10.0.0-m3, =10.0.0-m3, =10.2.0 Source cves: CVE-2026-73581 Source advisory: MEND:CVE-2026-73581...

CVE-2026-73581 Apache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore

Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0-M1 through...

CVE-2026-73581 Apache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore

Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0-M1 through...

EUVD-2026-85222

Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.58, from 9.0.0-M1 through...