CVE-2026-73581: Apache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore
Moderate Tomcat CVE-2026-73581 makes OpenSSL TLS stacks ignore CRLs for keystore certificates.
Mark Thomas disclosed CVE-2026-73581, a moderate improper certificate-revocation check in Apache Tomcat. The OpenSSL and OpenSSL-FFM TLS implementations ignore certificate revocation lists when the certificate is loaded from a keystore. Affected versions include Tomcat 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, and 9.0.0.M1 through 9.0.121, with 8.5 also listed through 8.5.100. Releases through 8.5.0 are unaffected, and the advisory does not report exploitation.
- Moderate improper certificate-revocation check in Tomcat TLS
- OpenSSL and OpenSSL-FFM ignore CRLs when the certificate uses a keystore
- Affects Tomcat 9.0, 10.1, and 11.0 through the listed builds
- Tomcat through 8.5.0 is unaffected; exploitation is not reported
- CVEs
- CVE-2026-73581
- Products
- Apache TomcatOpenSSL
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-73581 | Certificate Revocation Check Bypass in Apache Tomcat TLS | 6.5 | — |
From the original article
Posted by Mark Thomas on Sep 23 Severity: moderate Affected versions: - Apache Tomcat 11. 0. 0-M1 through 11.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.