AI analysis
CVE-2026-73581 is an Improper Check for Certificate Revocation (CWE-299) vulnerability in Apache Tomcat's OpenSSL and OpenSSL-FFM TLS implementations. The flaw causes the server to ignore Certificate Revocation Lists (CRLs) when a certificate is provided via a keystore, meaning revoked certificates will still be accepted. This could allow an attacker presenting a revoked certificate to establish a trusted connection, potentially leading to man-in-the-middle attacks. The vulnerability affects multiple major versions of Tomcat, including supported and End-of-Life (EOL) releases. There is no known public proof-of-concept or active exploitation in the wild.
What to do: Upgrade Apache Tomcat to version 11.0.26, 10.1.59, or 9.0.122 as recommended by the vendor. If you are running an End-of-Life version (e.g., 8.5.x), you must upgrade to a supported release as no patch will be provided. Systems using keystores with OpenSSL or OpenSSL-FFM TLS implementations are at risk.
Affected
| Apache Tomcat | 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.58, 9.0.0-M1 through 9.0.121, and 8.5.0 through 8.5.100 (EOL) |
Estimated exposure
—No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.58, from 9.0.0-M1 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.59, 9.0.122, which fixes the issue.