Apache Tomcat 11.0.26 Fixes 12 Security Flaws Enabling WebSocket Bypass and DoS Attacks
Apache Tomcat 11.0.26 patches 12 flaws, including a WebSocket access-control bypass and several DoS bugs.
68
Vulnerability3 · 1 read
CVE-2026-73581
Certificate Revocation Check Bypass in Apache Tomcat TLS
- CVSS 3.1
- 6.5 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-73581 is an Improper Check for Certificate Revocation (CWE-299) vulnerability in Apache Tomcat's OpenSSL and OpenSSL-FFM TLS implementations. The flaw causes the server to ignore Certificate Revocation Lists (CRLs) when a certificate is provided via a keystore, meaning revoked certificates will still be accepted. This could allow an attacker presenting a revoked certificate to establish a trusted connection, potentially leading to man-in-the-middle attacks. The vulnerability affects multiple major versions of Tomcat, including supported and End-of-Life (EOL) releases. There is no known public proof-of-concept or active exploitation in the wild.
What to do: Upgrade Apache Tomcat to version 11.0.26, 10.1.59, or 9.0.122 as recommended by the vendor. If you are running an End-of-Life version (e.g., 8.5.x), you must upgrade to a supported release as no patch will be provided. Systems using keystores with OpenSSL or OpenSSL-FFM TLS implementations are at risk.
| Product | Affected |
|---|---|
| Apache Tomcat | 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.58, 9.0.0-M1 through 9.0.121, and 8.5.0 through 8.5.100 (EOL) |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0-M1 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.59, 9.0.122, which fixes the issue.
- Weakness
- CWE-299
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
In the news
3 storiesApache Tomcat Update Fixes WebSocket and HTTP/2 Flaws Affecting Server Security
Apache Tomcat 11.0.26 patches 12 flaws, including WebSocket smuggling and an HTTP/2 header mix-up.
68
CVE-2026-73581: Apache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore
Moderate Tomcat CVE-2026-73581 makes OpenSSL TLS stacks ignore CRLs for keystore certificates.
48