Improper Certificate Revocation Check in Apache Tomcat Affects Multiple Versions
CVE-2026-73581

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Tomcat
Vendor
CVE Published:
23 September 2026

What is CVE-2026-73581?

An improper check for certificate revocation vulnerability exists in the Apache Tomcat server, affecting OpenSSL and OpenSSL-FFM TLS implementations. These implementations neglect to verify Certificate Revocation Lists (CRLs) when certificates utilize a keystore. This vulnerability compromises the intended security of applications relying on valid certificate checks and could expose systems to potential security risks. Users are urged to update to version 11.0.26, 10.1.59, or 9.0.122 to mitigate this issue.

Affected Version(s)

Apache Tomcat 11.0.0-M1 <= 11.0.25

Apache Tomcat 10.1.0-M1 <= 10.1.59

Apache Tomcat 9.0.0.M1 <= 9.0.121

References

https://lists.apache.org/thread/r0dj3h1pbn4wv96fhsfrnz3t6...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

arpitjain099 (https://github.com/arpitjain099)
.