CVE-2026-53434: Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat: from 11.0.0-M1 throug

criticalCVSS 9.1CVE-2026-53434

Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM based connector. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M7 through 10.1.55, from 9.0.83 through 9.0.118. Users are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fixes the issue.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: critical — CVSS 9.1
Published: 2026-06-29
Last updated: 2026-07-02
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-53434

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-534340.37% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 29% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-53434	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

medium[UPDATE] [medium] Apache Tomcat: Multiple vulnerabilitiescert-bund
unknownApache Tomcat Multiple Vulnerabilitieshkcert
unknownMultiple vulnerabilities in Apache Tomcat (June 30, 2026)cert-fr-avis

Recent advisories for Detection of Error

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

unknownCVE-2026-53291: In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/conexant: Fix mi…nvd · 2026-06-26
mediumCVE-2026-53291: ALSA: hda/conexant: Fix missing error check for jack detectionmsrc · 2026-06-09
criticalexploitedCVE-2021-1906: Qualcomm Multiple Chipsets Detection of Error Condition Without Action Vulnerabilitycisa-kev · 2021-11-03