1. Overview

After reviewing the impact of multiple Apache Tomcat vulnerabilities on the Tmax Tibero product suite, we confirm that there is no impact.

All of these vulnerabilities are classified as Low severity by Apache standards, and no critical effects such as remote code execution or authentication bypass have been reported.

2. Product Impact Analysis

Based on the Apache Tomcat version, all three CVEs fall within the affected versions and may be detected by vulnerability scanners.

However, each product does not meet the preconditions for exploiting these vulnerabilities, so there is no practical impact. Therefore, urgent patches or separate workarounds are not necessary.

Additional Checks

• Scripts modifying server.xml only exist for port changes (sed) in install.sh.
• _setup_ssl.sh and regen-cert manage only the server keystore and do not change connector protocols or client authentication settings.
• Therefore, the exploitation conditions for these vulnerabilities are not met during installation or operation.

3. Vulnerability Details - Risk Matrix

* Items without an official CVSS 3.1 score published are marked N/A and sorted by Apache’s own severity rating (Low).

4. Individual Vulnerability Details

CVE-2026-53404 — RewriteValve OR Condition Logic Error (Bad ornext processing)

In Tomcat's RewriteValve, when rewrite rules mix OR conditions with regular conditions like "A or B, and C," an error causes the evaluation to behave as if "A alone is sufficient." In environments using rewrite rules for access control, host verification, or path isolation as security boundaries, requests may inadvertently be allowed.

Recommended Action

Upgrade to versions 9.0.119 / 10.1.56 / 11.0.23. If you have rules placing mandatory conditions after an OR chain in RewriteValve, review those rules before upgrading to verify they behave as intended.

CVE-2026-53434 — FFM Connector Incorrect CRL Setting Ignored

In the FFM (Foreign Function & Memory) based connector, if the CRL (Certificate Revocation List) configuration is invalid, the error is ignored and the service starts normally. This poses a risk where revoked client certificates may not be rejected in management interfaces or partner gateways that verify client certificates via mTLS.

Recommended Action

If you use CRL-based client certificate verification with the FFM connector, upgrade to the patched version as a top priority. Before upgrading, it is recommended to verify via logs that the CRL settings are loaded correctly.

CVE-2026-55276 — Missing Authorization Information in effective web.xml Logs

When using the logEffectiveWebXml option, special roles (*, **) and empty authorization constraints (<auth-constraint/>) are missing from the merged web.xml logs. While this does not affect runtime authorization, audits or compliance reviews relying on these logs may misinterpret the configuration as more permissive than it actually is.

Recommended Action

Since there is no impact on runtime security, upgrade according to your regular patch schedule.

However, if recent audits or reviews have used the effective web.xml logs as reference, re-examine the original deployed web.xml or annotation-based security settings.

5. Resolution

• For environments using Tomcat 9.0.x: upgrade to 9.0.119 or later
• For environments using Tomcat 10.1.x: upgrade to 10.1.56 or later
• For environments using Tomcat 11.0.x: upgrade to 11.0.23 or later
• For Tomcat 8.5 series (EOL): since community support has ended and official patches are not provided, consider migrating to a supported version or reviewing commercial support (EOL vendor patches)

6. Temporary Mitigation Measures

If immediate upgrades are difficult, consider the following temporary measures.

• CVE-2026-53404: Review RewriteValve rules for patterns where mandatory conditions follow an OR chain, and simplify rules if possible as a temporary workaround
• CVE-2026-53434: Supplement FFM connector’s CRL settings by enforcing certificate validation at an external reverse proxy/load balancer layer
• CVE-2026-55276: For audit purposes, verify access control settings using the deployed web.xml or annotation-based configuration rather than relying on logs

References

• Apache Tomcat 9 Security Advisories — https://tomcat.apache.org/security-9.html
• Apache Tomcat 10 Security Advisories — https://tomcat.apache.org/security-10.html
• Apache Tomcat 11 Security Advisories — https://tomcat.apache.org/security-11.html
• NVD - CVE-2026-53404 — https://nvd.nist.gov/vuln/detail/CVE-2026-53404
• NVD - CVE-2026-53434 — https://nvd.nist.gov/vuln/detail/CVE-2026-53434
• NVD - CVE-2026-55276 — https://nvd.nist.gov/vuln/detail/CVE-2026-55276

Revision History

Major revisions (e.g., 1.0 → 2.0) are assigned when new CVEs are registered or patch information changes; minor revisions (e.g., 1.0 → 1.1) are for changes to FAQs, mitigations, references, or other supplementary information.