Changes.Watch~ upgrade verdicts ~
Free digest
ExploitedPHP2Shell is now on CISA KEV

critical vulnerability

Apache Tomcat util accepted misconfigured CRLs

Fix availableCritical · CVSS 9.1EPSS 0.59%

Published Jun 29, 2026 · updated Oct 23, 2026

What to do

  1. Upgrade to a fixed version: org.apache.tomcat:tomcat-util 11.0.23, org.apache.tomcat:tomcat-util 10.1.56, org.apache.tomcat:tomcat-util 9.0.119.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

Mavenorg.apache.tomcat:tomcat-util

Vulnerable versions
>= 11.0.0-M1, <= 11.0.22
Fixed in
11.0.23

Check your project: mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat-util

Mavenorg.apache.tomcat:tomcat-util

Vulnerable versions
>= 10.1.0-M7, <= 10.1.55
Fixed in
10.1.56

Check your project: mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat-util

Mavenorg.apache.tomcat:tomcat-util

Vulnerable versions
>= 9.0.83, <= 9.0.118
Fixed in
9.0.119

Check your project: mvn dependency:tree -Dincludes=org.apache.tomcat:tomcat-util

Sources

CWE-390 Detection of Error Condition Without Action

← All critical vulnerabilities