You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Mark Thomas <ma...@apache.org> on 2026/09/23 10:01:22 UTC
[SECURITY] CVE-2026-73581 Apache Tomcat - OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore
CVE-2026-73581 Apache Tomcat - OpenSSL and OpenSSL-FFM TLS
implementations ignore CRLs when certificate uses a keystore
Severity: Moderate
Vendor: The Apache Software Foundation
Versions Affected:
Apache Tomcat 11.0.0-M1 to 11.0.25
Apache Tomcat 10.1.0-M1 to 10.1.59
Apache Tomcat 9.0.0.M1 to 9.0.121
Description:
Both the OpenSSL and OpenSSL-FFM TLS implementations ignored CRLs when
certificate used a keystore.
Mitigation:
Users of the affected versions should apply one of the following
mitigations:
- Remove the examples web application
- Upgrade to Apache Tomcat 11.0.26
- Upgrade to Apache Tomcat 10.1.60
- Upgrade to Apache Tomcat 9.0.122
Credit:
This issue was identified by:
- arpitjain099 (https://github.com/arpitjain099)
History:
2026-09-23 Original advisory
References:
[1] https://tomcat.apache.org/security-11.html
[2] https://tomcat.apache.org/security-10.html
[3] https://tomcat.apache.org/security-9.html
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
[UPDATE][SECURITY] CVE-2026-73581 Apache Tomcat - OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore
Posted by Mark Thomas <ma...@apache.org>.
CVE-2026-73581 Apache Tomcat - OpenSSL and OpenSSL-FFM TLS
implementations ignore CRLs when certificate uses a keystore
Severity: Moderate
Vendor: The Apache Software Foundation
Versions Affected:
Apache Tomcat 11.0.0-M1 to 11.0.25
Apache Tomcat 10.1.0-M1 to 10.1.59
Apache Tomcat 9.0.0.M1 to 9.0.121
Description:
Both the OpenSSL and OpenSSL-FFM TLS implementations ignored CRLs when
certificate used a keystore.
Mitigation:
Users of the affected versions should apply one of the following
mitigations:
- Upgrade to Apache Tomcat 11.0.26
- Upgrade to Apache Tomcat 10.1.60
- Upgrade to Apache Tomcat 9.0.122
Credit:
This issue was identified by:
- arpitjain099 (https://github.com/arpitjain099)
History:
2026-09-28 Correction. Removing the examples app is not a mitigation
2026-09-23 Original advisory
References:
[1] https://tomcat.apache.org/security-11.html
[2] https://tomcat.apache.org/security-10.html
[3] https://tomcat.apache.org/security-9.html
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
[UPDATE][SECURITY] CVE-2026-73581 Apache Tomcat - OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore
Posted by Mark Thomas <ma...@apache.org>.
CVE-2026-73581 Apache Tomcat - OpenSSL and OpenSSL-FFM TLS
implementations ignore CRLs when certificate uses a keystore
Severity: Moderate
Vendor: The Apache Software Foundation
Versions Affected:
Apache Tomcat 11.0.0-M1 to 11.0.25
Apache Tomcat 10.1.0-M1 to 10.1.59
Apache Tomcat 9.0.0.M1 to 9.0.121
Description:
Both the OpenSSL and OpenSSL-FFM TLS implementations ignored CRLs when
certificate used a keystore.
Mitigation:
Users of the affected versions should apply one of the following
mitigations:
- Upgrade to Apache Tomcat 11.0.26
- Upgrade to Apache Tomcat 10.1.60
- Upgrade to Apache Tomcat 9.0.122
Credit:
This issue was identified by:
- arpitjain099 (https://github.com/arpitjain099)
History:
2026-09-28 Correction. Removing the examples app is not a mitigation
2026-09-23 Original advisory
References:
[1] https://tomcat.apache.org/security-11.html
[2] https://tomcat.apache.org/security-10.html
[3] https://tomcat.apache.org/security-9.html
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[UPDATE][SECURITY] CVE-2026-73581 Apache Tomcat - OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore
Posted by Mark Thomas <ma...@apache.org>.
CVE-2026-73581 Apache Tomcat - OpenSSL and OpenSSL-FFM TLS
implementations ignore CRLs when certificate uses a keystore
Severity: Moderate
Vendor: The Apache Software Foundation
Versions Affected:
Apache Tomcat 11.0.0-M1 to 11.0.25
Apache Tomcat 10.1.0-M1 to 10.1.59
Apache Tomcat 9.0.0.M1 to 9.0.121
Description:
Both the OpenSSL and OpenSSL-FFM TLS implementations ignored CRLs when
certificate used a keystore.
Mitigation:
Users of the affected versions should apply one of the following
mitigations:
- Upgrade to Apache Tomcat 11.0.26
- Upgrade to Apache Tomcat 10.1.60
- Upgrade to Apache Tomcat 9.0.122
Credit:
This issue was identified by:
- arpitjain099 (https://github.com/arpitjain099)
History:
2026-09-28 Correction. Removing the examples app is not a mitigation
2026-09-23 Original advisory
References:
[1] https://tomcat.apache.org/security-11.html
[2] https://tomcat.apache.org/security-10.html
[3] https://tomcat.apache.org/security-9.html
Re: [SECURITY] CVE-2026-73581 Apache Tomcat - OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore
Posted by "James H. H. Lampert via users" <us...@tomcat.apache.org>.
Thanks.
On 9/23/26 9:29 AM, Mark Thomas wrote:
. . .
> It depends. If the AprLifecyleListener or OpenSSLLifecycleListener is
> present they might. Check the logs. The connector name will be something
> like https-jsse-nio-443 if it is using JSSE and https-openssl-nio-443 if
> using OpenSSL (that example is for Tomcat Native).
I just scanned the current catalina.out at two different customers (one
still on 8.5, the other on 9); "https-jsse-nio-443" occurs many times in
both, while "openssl" does not occur at all. I think we're good on this.
> I mean the web application with context path "/examples" that is
> normally found at $CATALINA_BASE/webapps/examples.
Ah. I can't recall the last time I did anything with that one either,
other than to delete it along with docs, host-manager, and the default
ROOT. Not even sure what it does.
--
JHHL
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: [SECURITY] CVE-2026-73581 Apache Tomcat - OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore
Posted by Mark Thomas <ma...@apache.org>.
On 23/09/2026 16:54, James H. H. Lampert via users wrote:
> On 9/23/26 3:01 AM, Mark Thomas wrote:
>> - Remove the examples web application
>
> My, this was an awful lot of security-related mitigation announcements.
Better get used to it. It is looking like this is the new normal. At
least for now.
> First, please refresh my memory: on an IBM Midrange box, do connectors
> in the general form
>
>> <Connector port="443"
>> protocol="org.apache.coyote.http11.Http11Protocol"
>> keystoreFile="<REDACTED Java keystore pathname>"
>> maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
>> clientAuth="false" sslProtocol="TLSv1.2" />
>
> (some of our more security-conscious customers have things a bit
> tighter, like limits on acceptable ciphers) use OpenSSL in Tomcat 9?
It depends. If the AprLifecyleListener or OpenSSLLifecycleListener is
present they might. Check the logs. The connector name will be something
like https-jsse-nio-443 if it is using JSSE and https-openssl-nio-443 if
using OpenSSL (that example is for Tomcat Native).
> Second, by "the examples web application" do you mean the default ROOT
> context, or perhaps one of the other bundled webapp? Because we
> routinely strip out every bundled webapp other than Manager, simply
> because our own webapp is so enormous (we also have to expand the upload
> limit in Manager by a full order of magnitude), and Manager is the only
> bundled webapp that's of any practical use in the installations we manage.
I mean the web application with context path "/examples" that is
normally found at $CATALINA_BASE/webapps/examples.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: [SECURITY] CVE-2026-73581 Apache Tomcat - OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore
Posted by "James H. H. Lampert via users" <us...@tomcat.apache.org>.
On 9/23/26 3:01 AM, Mark Thomas wrote:
> - Remove the examples web application
My, this was an awful lot of security-related mitigation announcements.
First, please refresh my memory: on an IBM Midrange box, do connectors
in the general form
> <Connector port="443" protocol="org.apache.coyote.http11.Http11Protocol"
> keystoreFile="<REDACTED Java keystore pathname>"
> maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
> clientAuth="false" sslProtocol="TLSv1.2" />
(some of our more security-conscious customers have things a bit
tighter, like limits on acceptable ciphers) use OpenSSL in Tomcat 9?
Second, by "the examples web application" do you mean the default ROOT
context, or perhaps one of the other bundled webapp? Because we
routinely strip out every bundled webapp other than Manager, simply
because our own webapp is so enormous (we also have to expand the upload
limit in Manager by a full order of magnitude), and Manager is the only
bundled webapp that's of any practical use in the installations we manage.
--
JHHL
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
[UPDATE][SECURITY] CVE-2026-73581 Apache Tomcat - OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore
Posted by Mark Thomas <ma...@apache.org>.
CVE-2026-73581 Apache Tomcat - OpenSSL and OpenSSL-FFM TLS
implementations ignore CRLs when certificate uses a keystore
Severity: Moderate
Vendor: The Apache Software Foundation
Versions Affected:
Apache Tomcat 11.0.0-M1 to 11.0.25
Apache Tomcat 10.1.0-M1 to 10.1.59
Apache Tomcat 9.0.0.M1 to 9.0.121
Description:
Both the OpenSSL and OpenSSL-FFM TLS implementations ignored CRLs when
certificate used a keystore.
Mitigation:
Users of the affected versions should apply one of the following
mitigations:
- Upgrade to Apache Tomcat 11.0.26
- Upgrade to Apache Tomcat 10.1.60
- Upgrade to Apache Tomcat 9.0.122
Credit:
This issue was identified by:
- arpitjain099 (https://github.com/arpitjain099)
History:
2026-09-28 Correction. Removing the examples app is not a mitigation
2026-09-23 Original advisory
References:
[1] https://tomcat.apache.org/security-11.html
[2] https://tomcat.apache.org/security-10.html
[3] https://tomcat.apache.org/security-9.html