CVE-2026-86243: Apache Tomcat Native: DoS via TLS handshake
CVE-2026-86243 buffer over-read in Apache Tomcat Native can crash the JVM during TLS handshake.
58
Vulnerability6 · 1 read
CVE-2026-86243
TLS Handshake Buffer Over-Read Enables Remote DoS in Apache Tomcat Native
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache Tomcat Native (tc-native), the APR/OpenSSL-based connector library used with Apache Tomcat, contains a buffer over-read (CWE-126) in its handling of TLS handshakes. An unauthenticated remote attacker can trigger the flaw simply by sending a maliciously crafted TLS handshake to a server using the native connector, causing the JVM to crash and taking the affected application offline. The impact is denial of service only — the CVSS 3.1 vector (AV:N/AC:L/PR:N, C:N/I:N/A:H) indicates no confidentiality or integrity impact, and it is rated 7.5 (high). All deployments running Tomcat Native 2.0.0–2.0.15 or 1.3.0–1.3.8 (and possibly older unsupported releases) are affected. No public proof-of-concept exists, the flaw is not in the CISA Known Exploited Vulnerabilities catalog, and no exploitation has been observed in the wild.
What to do: Upgrade Tomcat Native to 2.0.16 (2.x line) or 1.3.9 (1.x line), or revert to an earlier fixed release if pinned. Because the flaw is triggered during the TLS handshake before any authentication, restrict TLS endpoint exposure (e.g., front with a reverse proxy or TLS-terminating load balancer) where upgrading is not immediately possible; switching the connector from APR/native to Java NIO with JSSE also removes the vulnerable code path. Check for unexplained JVM crashes in logs as an indicator of attempted exploitation.
| Product | Affected |
|---|---|
| Apache Software Foundation Apache Tomcat Native | 2.0.0 through 2.0.15 |
| Apache Software Foundation Apache Tomcat Native | 1.3.0 through 1.3.8 |
| Apache Software Foundation Apache Tomcat Native | versions prior to 1.3.0 (unsupported; may also be affected) |
Estimated exposure
large≈10^5 (on the order of hundreds of thousands) of servers worldwide, clearly an estimate — Tomcat is one of the most widely deployed servlet containers with hundreds of thousands to millions of internet-facing hosts seen in public scans, and while Tomcat Native is an optional component (commonly installed via distro packages and…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versions may also be affected. Users are recommended to upgrade to version 1.3.9 or 2.0.16, which fix the issue.