CVE-2026-73581: Apache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore
Moderate Tomcat CVE-2026-73581 makes OpenSSL TLS stacks ignore CRLs for keystore certificates.
Mark Thomas disclosed CVE-2026-73581, a moderate improper certificate-revocation check in Apache Tomcat. The OpenSSL and OpenSSL-FFM TLS implementations ignore certificate revocation lists when the certificate is loaded from a keystore. Affected versions include Tomcat 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, and 9.0.0.M1 through 9.0.121, with 8.5 also listed through 8.5.100. Releases through 8.5.0 are unaffected, and the advisory does not report exploitation.
- Moderate improper certificate-revocation check in Tomcat TLS
- OpenSSL and OpenSSL-FFM ignore CRLs when the certificate uses a keystore
- Affects Tomcat 9.0, 10.1, and 11.0 through the listed builds
- Tomcat through 8.5.0 is unaffected; exploitation is not reported
Vulnerabilities mentionedAll →
- CVE-2026-735816.5—Certificate Revocation Check Bypass in Apache Tomcat TLSpublished · Apache Tomcat
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-73581 | Certificate Revocation Check Bypass in Apache Tomcat TLS CVE-2026-73581 is an Improper Check for Certificate Revocation (CWE-299) vulnerability in Apache Tomcat's OpenSSL and OpenSSL-FFM TLS implementations. The flaw causes the server to ignore Certificate Revocation Lists (CRLs) when a certificate is provided via a keystore, meaning revoked certificates will still be accepted. This could allow an attacker presenting a revoked certificate to establish a trusted connection, potentially leading to man-in-the-middle attacks. The vulnerability affects multiple major versions of Tomcat, including supported and End-of-Life (EOL) releases. There is no known public proof-of-concept or active exploitation in the wild. Do: Upgrade Apache Tomcat to version 11.0.26, 10.1.59, or 9.0.122 as recommended by the vendor. If you are running an End-of-Life version (e.g., 8.5.x), you must upgrade to a supported release as no patch will be provided. Systems using keystores with OpenSSL or OpenSSL-FFM TLS implementations are at risk. |
Posted by Mark Thomas on Sep 23 Severity: moderate Affected versions: - Apache Tomcat 11.0.0-M1 through 11.0.25 - Apache Tomcat 10.1.0-M1 through 10.1.59 - Apache Tomcat 9.0.0.M1 through 9.0.121 - Apache Tomcat 8.5.0 through 8.50.100 - Apache Tomcat through 8.5.0 unaffected Description: Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. This issue...
This source does not provide full text. Read it at seclists.org.