CVE-2026-73581

Overview

Apache Tomcat is an open-source implementation of the Jakarta Servlet, Jakarta Pages, Jakarta Expression Language, Jakarta WebSocket, Jakarta Annotations, and Jakarta Authentication specifications. It serves Java web applications either as a standalone servlet container and HTTP server or embedded inside an application through the tomcat-embed-core artifact. Its Catalina servlet container (org.apache.tomcat:tomcat-catalina) supplies the request-processing pipeline, including Valves such as RewriteValve, along with connectors, realms, and session management.

An Authorization Bypass vulnerability (CVE-2026-73581) has been identified in the OpenSSL TLS implementation of Apache Tomcat (OpenSSLContext), which allows attackers holding a revoked client certificate to complete TLS client-certificate authentication. When the server certificate is loaded from a Java keystore rather than from PEM files, the configured certificate revocation list (CRL) is never loaded into the OpenSSL context, so revoked client certificates are accepted as valid.

Per OWASP: Confirmation of the user's identity, authentication, and session management is critical to protect against authentication-related attacks.

This issue affects the 8.5.x line (8.5.0 through 8.5.100), versions 9.0.0.M1 through 9.0.121, 10.1.0-M1 through 10.1.59, and 11.0.0-M1 through 11.0.25 of Apache Tomcat.

Details

Module Info

• Product: Apache Tomcat
• Affected packages: org.apache.tomcat:tomcat-coyote, org.apache.tomcat.embed:tomcat-embed-core
• Affected versions: >=8.5.0 <=8.5.100, >=9.0.0.M1 <9.0.122, >=10.1.0-M1 <10.1.60, >=11.0.0-M1 <11.0.26
• GitHub repository: https://github.com/apache/tomcat

• Published packages: https://central.sonatype.com/artifact/org.apache.tomcat/tomcat-coyote, https://central.sonatype.com/artifact/org.apache.tomcat.embed/tomcat-embed-core

• Package manager: Maven
• Fixed in:
  
  • NES for Apache Tomcat 8.5.100-tomcat-8.5.112
  • Apache Tomcat 11.0.26, 10.1.60, 9.0.122 (OSS)

Vulnerability Info

This Medium-severity vulnerability is found in the org.apache.tomcat:tomcat-coyote package (and the shaded org.apache.tomcat.embed:tomcat-embed-core package) in the 8.5.x line and versions 9.0.0.M1 through 9.0.121, 10.1.0-M1 through 10.1.59, and 11.0.0-M1 through 11.0.25 of Apache Tomcat.

When a TLS connector uses the OpenSSL implementation (the APR/native connector, or NIO/NIO2 with the OpenSSL implementation) and client certificates are verified by OpenSSL against caCertificateFile/caCertificatePath, administrators revoke client certificates by setting certificateRevocationListFile or certificateRevocationListPath on the SSLHostConfig. OpenSSLContext.addCertificate installs the server certificate in one of two ways: from PEM files (certificateFile) or from a Java keystore (certificateKeystoreFile with an alias). The only call that loads the CRL into the native OpenSSL context, SSLContext.setCARevocation, sits inside the PEM branch:

public void addCertificate(SSLHostConfigCertificate certificate) throws Exception {

    // Load Server key and certificate
    if (certificate.getCertificateFile() != null) {
        // Set certificate
        ...
        SSLContext.setCertificate(ctx,
                SSLHostConfig.adjustRelativePath(certificate.getCertificateFile()),
                SSLHostConfig.adjustRelativePath(certificate.getCertificateKeyFile()),
                passwordToUse, getCertificateIndex(certificate));
        // Set certificate chain file
        SSLContext.setCertificateChainFile(ctx,
                SSLHostConfig.adjustRelativePath(certificate.getCertificateChainFile()), false);
        // Set revocation
        SSLContext.setCARevocation(ctx,
                SSLHostConfig.adjustRelativePath(
                        sslHostConfig.getCertificateRevocationListFile()),
                SSLHostConfig.adjustRelativePath(
                        sslHostConfig.getCertificateRevocationListPath()));
    } else {
        String alias = certificate.getCertificateKeyAlias();
        X509KeyManager x509KeyManager = certificate.getCertificateKeyManager();
        ...
        PrivateKey key = x509KeyManager.getPrivateKey(alias);
        ...
        SSLContext.setCertificateRaw(ctx, chain[0].getEncoded(),
                sb.toString().getBytes(StandardCharsets.US_ASCII),
                getCertificateIndex(certificate));
        for (int i = 1; i < chain.length; i++) {
            SSLContext.addChainCertificateRaw(ctx, chain[i].getEncoded());
        }
    }
}

When the server certificate comes from a keystore, the else branch runs and no revocation data is ever handed to OpenSSL. The connector starts without error and the CRL configuration is silently ignored, so a client presenting a certificate that chains to a trusted CA but has been revoked completes the TLS handshake and is treated as an authenticated client by CLIENT-CERT authentication, realms, and any application logic that relies on the client certificate. The Tomcat 11.0.x and 10.1.x OpenSSL-FFM implementation carries the same flaw; the 8.5.x line does not ship OpenSSL-FFM and is affected through the tomcat-native OpenSSL implementation only.

Mitigation

Only recent versions of Apache Tomcat are community-supported. The community support version will not receive any updates to address this issue. For more information, see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a patched version of Apache Tomcat.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• arpitjain099 (finder)