GHSA-4x29-79gh-6v8q

Suggest an improvement
Source
https://github.com/advisories/GHSA-4x29-79gh-6v8q
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-4x29-79gh-6v8q/GHSA-4x29-79gh-6v8q.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-4x29-79gh-6v8q
Aliases
Published
2026-06-29T21:32:15Z
Modified
2026-10-23T22:10:52Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Apache Tomcat util accepted misconfigured CRLs
Details

Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring Certificate Revocation List (CRLs) for a FFM based connector. If an FFM connector was configured with invalid CRLs, the invalid CRLs were ignored meaning invalid certificates could be accepted.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118.

Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.

Database specific 
{
    "cwe_ids":  [
        "CWE-390"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-10-23T21:42:39Z",
    "nvd_published_at":  "2026-06-29T21:16:44Z",
    "severity":  "CRITICAL"
}
References

Affected packages

Maven / org.apache.tomcat:tomcat-util

Package

Name
org.apache.tomcat:tomcat-util
View open source insights on deps.dev
Purl
pkg:maven/org.apache.tomcat/tomcat-util

Affected ranges

Type
ECOSYSTEM
Events
Introduced
11.0.0-M1
Fixed
11.0.23

Affected versions

11.*
11.0.0-M1
11.0.0-M3
11.0.0-M4
11.0.0-M5
11.0.0-M6
11.0.0-M7
11.0.0-M9
11.0.0-M10
11.0.0-M11
11.0.0-M12
11.0.0-M13
11.0.0-M14
11.0.0-M15
11.0.0-M16
11.0.0-M17
11.0.0-M18
11.0.0-M19
11.0.0-M20
11.0.0-M21
11.0.0-M22
11.0.0-M24
11.0.0-M25
11.0.0-M26
11.0.0
11.0.1
11.0.2
11.0.3
11.0.4
11.0.5
11.0.6
11.0.7
11.0.8
11.0.9
11.0.10
11.0.11
11.0.12
11.0.13
11.0.14
11.0.15
11.0.18
11.0.20
11.0.21
11.0.22

Database specific

last_known_affected_version_range 
"<= 11.0.22"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-4x29-79gh-6v8q/GHSA-4x29-79gh-6v8q.json"

Maven / org.apache.tomcat:tomcat-util

Package

Name
org.apache.tomcat:tomcat-util
View open source insights on deps.dev
Purl
pkg:maven/org.apache.tomcat/tomcat-util

Affected ranges

Type
ECOSYSTEM
Events
Introduced
10.1.0-M7
Fixed
10.1.56

Affected versions

10.*
10.1.0-M7
10.1.0-M8
10.1.0-M10
10.1.0-M11
10.1.0-M12
10.1.0-M14
10.1.0-M15
10.1.0-M16
10.1.0-M17
10.1.0
10.1.1
10.1.2
10.1.4
10.1.5
10.1.6
10.1.7
10.1.8
10.1.9
10.1.10
10.1.11
10.1.12
10.1.13
10.1.14
10.1.15
10.1.16
10.1.17
10.1.18
10.1.19
10.1.20
10.1.23
10.1.24
10.1.25
10.1.26
10.1.28
10.1.29
10.1.30
10.1.31
10.1.33
10.1.34
10.1.35
10.1.36
10.1.39
10.1.40
10.1.41
10.1.42
10.1.43
10.1.44
10.1.45
10.1.46
10.1.47
10.1.48
10.1.49
10.1.50
10.1.52
10.1.53
10.1.54
10.1.55

Database specific

last_known_affected_version_range 
"<= 10.1.55"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-4x29-79gh-6v8q/GHSA-4x29-79gh-6v8q.json"

Maven / org.apache.tomcat:tomcat-util

Package

Name
org.apache.tomcat:tomcat-util
View open source insights on deps.dev
Purl
pkg:maven/org.apache.tomcat/tomcat-util

Affected ranges

Type
ECOSYSTEM
Events
Introduced
9.0.83
Fixed
9.0.119

Affected versions

9.*
9.0.83
9.0.84
9.0.85
9.0.86
9.0.87
9.0.88
9.0.89
9.0.90
9.0.91
9.0.93
9.0.94
9.0.95
9.0.96
9.0.97
9.0.98
9.0.99
9.0.100
9.0.102
9.0.104
9.0.105
9.0.106
9.0.107
9.0.108
9.0.109
9.0.110
9.0.111
9.0.112
9.0.113
9.0.115
9.0.116
9.0.117
9.0.118

Database specific

last_known_affected_version_range 
"<= 9.0.118"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-4x29-79gh-6v8q/GHSA-4x29-79gh-6v8q.json"