Detection of Error Condition Without Action vulnerability in Apache Tomcat when configuring CRLs for a FFM…

CVE-2026-53434 is a CWE-390 Detection of Error Condition Without Action bug in Apache Tomcat's FFM (Foreign Function & Memory) connector — the modern Panama-based port of the Tomcat Native/OpenSSL TLS stack. When the connector is configured to enforce client-cert validation against a Certificate Revocation List, and the supplied CRL fails to load (malformed, expired, wrong path, unreadable), the FFM code path silently swallows the error instead of failing closed. Net effect: the connector continues to serve mTLS handshakes with no revocation checking at all, so a revoked client certificate can still authenticate. Affected ranges are roughly 9.0.83 → 9.0.118, 10.1.x through 10.1.51-ish, and 11.0.x through 11.0.17, with the FFM connector being mandatory only when operators chose it explicitly.

Apache rated this Low and they're right. The bug doesn't grant code execution, RCE, or unauthenticated access — it degrades the *strength* of an already-optional security feature (client-cert revocation) only on a non-default connector type, and only when CRLs are misconfigured. The realistic victim profile is narrow: organizations doing mTLS with a CRL-based PKI on the FFM connector with a stale or broken CRL file. Vendor severity matches reality.

Why this verdict

• Niche connector: FFM is the new Panama-based stack — most production Tomcat is JSSE or APR; FFM-only bug = small affected fleet.
• Compounding precondition: requires CRL-file mTLS configuration AND a broken CRL AND attacker possession of a previously-valid, now-revoked cert+key. Three independent unlikelies multiply.
• No primitives gained: no RCE, no auth bypass for never-trusted attackers, no privilege escalation — only weakens revocation against pre-issued, pre-trusted identities.
• Role multiplier: Tomcat in a low/typical role (LOB app server, microservice host) — chain ends in revoked-identity reuse, bounded by that identity's prior permissions. In a high-value role (Tomcat fronting an IdP, ADFS proxy, internal CA web UI, secrets-manager front-end), the chain ends in impersonation of a revoked admin — but even then the CRL-misconfig precondition keeps the affected installed-base share well below the 1% floor that would force HIGH.
• No KEV, no EPSS spike, no PoC — threat intel signal is flat.

Why not higher?

Not MEDIUM/HIGH because the bug requires multiple pre-existing conditions to align (FFM, CRL-mTLS, broken CRL, attacker-held revoked cert+key) and produces no new attacker primitives — it only reduces a defence-in-depth control's strength against a population the operator already chose to issue certs to. No KEV, no PoC, no observed exploitation.

Why not lower?

Not IGNORE because there *is* a real security regression: revocation checking is the entire point of CRL configuration, and a silent failure mode violates the operator's explicit security policy. Audit and compliance frameworks (FIPS, PCI-DSS mTLS scopes) will care.

1. Inventory FFM connector + CRL usage across the fleet — Grep server.xml / SSLHostConfig for FFM protocol classes plus certificateRevocationListFile. If the intersection is empty, you're not exposed. Complete within the noisgate remediation window (no mitigation SLA at LOW).
2. Validate CRL files load cleanly on every Tomcat restart — Pre-flight check the CRL with openssl crl -in <file> -noout -text in your deploy pipeline; fail the deploy if it errors. This neutralises the bug entirely even on unpatched Tomcat — apply opportunistically alongside the next release window.
3. Switch FFM CRL-mTLS deployments to JSSE or APR temporarily — Both JSSE and APR fail-closed on bad CRLs. If you're on the FFM connector specifically for performance/Panama reasons, this is a 1-line protocol change in server.xml until you upgrade.
4. Patch to 9.0.119 / 10.1.52 / 11.0.18 — Vendor fix aligns FFM behaviour with JSSE/APR (throws on CRL load error). Roll this in the standard 365-day noisgate remediation SLA for LOW; no fast-track needed.

Run on each Tomcat host as the Tomcat service user (read access to $CATALINA_BASE/conf). Example: ./check-cve-2026-53434.sh /opt/tomcat. Exits VULNERABLE if FFM+CRL config is found on an unpatched version, PATCHED if version is fixed or config is absent, UNKNOWN otherwise.

#!/usr/bin/env bash
# noisgate verifier: CVE-2026-53434 — Tomcat FFM CRL silent-ignore
# Usage: ./check-cve-2026-53434.sh <CATALINA_BASE>
set -u
BASE="${1:-/opt/tomcat}"
CONF="$BASE/conf"
LIB="$BASE/lib"

if [ ! -d "$CONF" ] || [ ! -d "$LIB" ]; then
  echo "UNKNOWN: $BASE does not look like a Tomcat install"
  exit 2
fi

# 1. Derive Tomcat version
VER=$(java -cp "$LIB/catalina.jar" org.apache.catalina.util.ServerInfo 2>/dev/null \
      | awk -F/ '/Server number/ {print $2}' \
      | tr -d '[:space:]')
if [ -z "$VER" ]; then
  VER=$(ls "$LIB" | grep -oE 'catalina-[0-9.]+\.jar' | head -1 | grep -oE '[0-9.]+')
fi
echo "Tomcat version detected: ${VER:-unknown}"

# 2. Is version fixed?
is_fixed() {
  local v="$1"
  case "$v" in
    9.0.*)  [ "${v#9.0.}" -ge 119 ] && return 0 ;;
    10.1.*) [ "${v#10.1.}" -ge 52 ] && return 0 ;;
    11.0.*) [ "${v#11.0.}" -ge 18 ] && return 0 ;;
  esac
  return 1
}

# 3. Look for FFM connector + CRL config
FFM_HIT=$(grep -RiE 'protocol="[^"]*(OpenSSL|FFM|Panama)[^"]*"' "$CONF" 2>/dev/null | head -5)
CRL_HIT=$(grep -RiE 'certificateRevocationListFile' "$CONF" 2>/dev/null | head -5)

if [ -z "$FFM_HIT" ] || [ -z "$CRL_HIT" ]; then
  echo "PATCHED: FFM connector + CRL configuration not both present — not exposed"
  exit 0
fi

if is_fixed "$VER"; then
  echo "PATCHED: version $VER >= fixed release"
  exit 0
fi

echo "VULNERABLE: FFM connector with CRL on unpatched Tomcat $VER"
echo "--- FFM connector evidence ---"
echo "$FFM_HIT"
echo "--- CRL config evidence ---"
echo "$CRL_HIT"
exit 1

Sources

1. Apache Tomcat 11 security advisories
2. Apache Tomcat 10 security advisories
3. Apache Tomcat 9 security advisories
4. Apache Tomcat 9.0 Changelog
5. HeroDevs — Apache Tomcat CVE round-up (April 2026)
6. MITRE CVE keyword search — Tomcat
7. OpenCVE — Apache Tomcat tracker
8. CWE-390: Detection of Error Condition Without Action