Apache Tomcat Util Accepted Misconfigured CRLs

🗓️ 24 Oct 2026 09:47:38Reported by Veracode Vulnerability DatabaseType

Apache Tomcat accepts invalid CRLs in FFM connectors, potentially accepting invalid certs.

Reporter	Title	Published	Views	Family All 173
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Apache Tomcat	22 Oct 202617:02	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor component uses multiple third-party libraries that are vulnerable to several security vulnerabilities.	3 Nov 202610:34	–	ibm
attackerkb	CVE-2026-53434	29 Jun 202620:41	–	attackerkb
Tenable Nessus	Amazon Linux 2023 : tomcat9, tomcat9-admin-webapps, tomcat9-el-3.0-api (ALAS2023-2026-1945)	20 Jul 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : tomcat10, tomcat10-admin-webapps, tomcat10-el-5.0-api (ALAS2023-2026-1946)	20 Jul 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2 : tomcat, --advisory ALAS2TOMCAT9-2026-027 (ALASTOMCAT9-2026-027)	20 Jul 202600:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0311: tomcat (ALINUX3-SA-2026:0311)	20 Oct 202600:00	–	nessus
Tenable Nessus	AlmaLinux 10 : tomcat9 (ALSA-2026:68651)	19 Sep 202600:00	–	nessus
Tenable Nessus	AlmaLinux 9 : tomcat (ALSA-2026:68660)	19 Sep 202600:00	–	nessus
Tenable Nessus	AlmaLinux 8 : tomcat (ALSA-2026:68677)	18 Sep 202600:00	–	nessus

Vulners

Node

apache tomcat-utilRange11.0.0-M1–11.0.22java

apache tomcat-utilRange10.1.0-M7–10.1.55java

apache tomcat-utilRange9.0.83–9.0.118java

Source	Link
openwall	www.openwall.com/lists/oss-security/2026/06/29/22
lists	www.lists.apache.org/thread/x510lbq0sfrd1qyo7q3r1mpllgpdcosk

26 Oct 2026 15:45Current

7.4High risk

Vulners AI Score7.4

CVSS 3.19.1

EPSS0.00586

SSVC