CVE-2026-73581CWE-299

CVE-2026-73581

Medium · published September 23, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
1.6
In the wild
Unconfirmed
What it is

Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0-M1 through 9.0.121.

The following versions were EOL at the time the CVE was created but are

known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected.

Users are recommended to upgrade to version 11.0.26, 10.1.59, 9.0.122, which fixes the issue.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00117 · 1.6th percentile
Weakness
CWE-299 · Improper Check for Certificate Revocation
Published
2026-09-23T16:17Z
References (2)
https://lists.apache.org/thread/r0dj3h1pbn4wv96fhsfrnz3t6874t6do · [email protected]http://www.openwall.com/lists/oss-security/2026/09/23/19 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 25 SEP 03:27Z
    EPSS moved — → 0%
    epss
  • 23 SEP 11:08Z
    Apache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore
    cvelistv5