CVE-2026-86247

Apache Tomcat Native (tc-native), the optional JNI library that lets Tomcat's APR/native connector use OpenSSL, contains a thread-level race condition (CWE-366) that can cause client certificate verification requirements to be downgraded for some configurations. If the race is won during TLS handshake processing, a server configured to require a valid client certificate (mutual TLS) may accept a connection without proper certificate verification, allowing an unauthenticated remote attacker to reach or impersonate clients on an endpoint that should have been protected. The flaw affects Tomcat Native 1.3.0 through 1.3.8 and 2.0.0 through 2.0.15, and unsupported older versions may also be affected; exploitation requires a vulnerable connector configuration plus favorable timing (reflected in the high attack-complexity CVSS score of 7.4). The impact is on confidentiality and integrity of mutually authenticated services, not availability. No public proof of concept is known, the issue is not on CISA's KEV list, and there are no reports of exploitation in the wild.

What to do: Upgrade Tomcat Native to 2.0.16 (2.0.x branch) or 1.3.9 (1.3.x branch) as soon as releases are available for your platform. Audit Tomcat servers for the APR/native connector combined with client certificate verification (e.g., clientAuth/SSLVerifyClient settings) — these are the configurations at risk, especially internet-facing or cross-trust-boundary mTLS endpoints. If patching must be delayed, consider switching affected connectors to the standard Java NIO/NIO2 connector with JSSE, which does not depend on the vulnerable library, and review access logs for unexpected handshakes from clients without valid certificates.