1. Overview

We are informing you that three security vulnerabilities disclosed in Apache Tomcat (CVE-2026-53404, CVE-2026-53434, CVE-2026-55276) may affect Tibero products.

All these vulnerabilities are classified as Low severity according to Apache standards, and no critical impacts such as remote code execution or authentication bypass have been reported. However, since they may affect access control and certificate verification logic, we recommend prompt patching in affected environments.

2. Product Impact Analysis

All three CVEs are included in the affected versions based on the Apache Tomcat version and may be detected by vulnerability scanners.

However, each product does not meet the prerequisites for exploitation of these vulnerabilities, so there is no practical impact. Therefore, urgent patches or separate workarounds are not required.

Additional Checks

• Scripts modifying server.xml only include port changes (sed) in install.sh.
• _setup_ssl.sh and regen-cert manage only the server keystore and do not alter connector protocols or client authentication settings.
• Therefore, the exploitation conditions for these vulnerabilities are not met during installation or operation.

3. Vulnerability Details - Risk Matrix

* Items without official CVSS 3.1 scores posted are marked as N/A, sorted by Apache’s own severity rating (Low).

4. Individual Vulnerability Details

CVE-2026-53404 — RewriteValve OR Condition Logic Error (Bad ornext processing)

In Tomcat’s RewriteValve, when rewrite rules mix OR conditions and regular conditions such as "A or B, and C," an error caused the evaluation to treat "A alone is sufficient" as true. In environments using rewrite rules as security boundaries for access control, host verification, or path isolation, requests may unintentionally pass through.

Recommended Action

Upgrade to versions 9.0.119 / 10.1.56 / 11.0.23. If you have RewriteValve rules that place mandatory conditions after OR chains, review those rules before upgrading to verify they behave as intended.

CVE-2026-53434 — Undetected Incorrect CRL Settings in FFM Connector

In the FFM (Foreign Function & Memory) based connector, if the CRL (Certificate Revocation List) setting is invalid, it is ignored without error detection, allowing the service to start. This poses a risk where revoked client certificates may not be rejected in management interfaces or partner gateways using mTLS client certificate verification.

Recommended Action

If you use CRL-based client certificate verification in the FFM connector, prioritize upgrading to the patched version. Before upgrading, we recommend verifying via logs that CRL settings are loaded correctly.

CVE-2026-55276 — Missing Authorization Information in effective web.xml Logs

When using the logEffectiveWebXml option, special roles (*, **) and empty authorization constraints (<auth-constraint/>) are missing from the merged web.xml output in logs. While this does not affect runtime authorization, if these logs are used as audit, inspection, or compliance evidence, it may lead to misunderstanding that settings are more permissive than they actually are.

Recommended Action

Since there is no impact on runtime security, upgrade according to your regular patch schedule.

However, if you have recently used effective web.xml logs as audit or inspection evidence, please re-examine against the actual deployed web.xml or annotation-based security configuration.

5. Remediation

• For environments using Tomcat 9.0.x: Upgrade to 9.0.119 or later
• For environments using Tomcat 10.1.x: Upgrade to 10.1.56 or later
• For environments using Tomcat 11.0.x: Upgrade to 11.0.23 or later
• For environments using Tomcat 8.5 series (EOL): Since community support has ended and official patches are not provided, consider migrating to a supported version or evaluate commercial support (EOL vendor patches)

6. Temporary Workarounds

If immediate upgrade is difficult, consider the following temporary measures.

• CVE-2026-53404: Check RewriteValve rules for patterns where mandatory conditions follow OR chains, and if possible, simplify rules to temporarily mitigate
• CVE-2026-53434: Supplement CRL settings in the FFM connector by implementing dual certificate verification at an external reverse proxy/load balancer layer
• CVE-2026-55276: For audit purposes, review deployed web.xml or annotation configuration files directly instead of relying on logs

7. References

• Apache Tomcat 9 Security Advisories — https://tomcat.apache.org/security-9.html
• Apache Tomcat 10 Security Advisories — https://tomcat.apache.org/security-10.html
• Apache Tomcat 11 Security Advisories — https://tomcat.apache.org/security-11.html
• NVD - CVE-2026-53404 — https://nvd.nist.gov/vuln/detail/CVE-2026-53404
• NVD - CVE-2026-53434 — https://nvd.nist.gov/vuln/detail/CVE-2026-53434
• NVD - CVE-2026-55276 — https://nvd.nist.gov/vuln/detail/CVE-2026-55276

Revision History

Major revisions (e.g., 1.0→2.0) are assigned for new CVE registrations or patch information changes; minor revisions (e.g., 1.0→1.1) are assigned for updates to FAQs, workarounds, or references.