Apache Tomcat Native (Product): news timeline & CVEs

CVE-2026-86247: Apache Tomcat Native: Client certificate requirements can be down-graded

Apache Tomcat Native CVE-2026-86247 can downgrade client-certificate checks via a race condition.

Mark Thomas disclosed CVE-2026-86247, a moderate-severity race condition in Apache Tomcat Native. Versions 2.0.0 through 2.0.15 and 1.3.0 through 1.3.8 are affected, and unsupported releases may be as well. In some configurations, the flaw can downgrade client-certificate verification requirements. The notice does not report observed exploitation.

oss-securitySep 23, 16:59 UTC · 3d agoVulnerability 15 sources CVE-2026-86247

CVE-2026-86246: Apache Tomcat Native: Insecure OpenSSL options enabled

Apache Tomcat Native enables insecure OpenSSL options by default, tracked as CVE-2026-86246.

Mark Thomas disclosed CVE-2026-86246, rated moderate, in Apache Tomcat Native. Versions 2.0.0 through 2.0.15 and 1.3.0 through 1.3.8 initialize TLS with insecure OpenSSL defaults, including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF, and ALLOW_NO_DHE_KEX. The oss-security post does not describe active exploitation.

oss-securitySep 23, 16:56 UTC · 3d agoVulnerability 15 sources CVE-2026-86246

CVE-2026-86243: Apache Tomcat Native: DoS via TLS handshake

CVE-2026-86243 buffer over-read in Apache Tomcat Native can crash the JVM during TLS handshake.

Apache rates CVE-2026-86243 important. A buffer over-read in Apache Tomcat Native during the TLS handshake lets a malicious user crash the JVM and cause a denial of service. Affected releases are 2.0.0 through 2.0.15 and 1.3.0 through 1.3.8; earlier unsupported versions may also be affected. The disclosure does not report active exploitation.

oss-securitySep 23, 16:54 UTC · 3d agoVulnerability 15 sources CVE-2026-862431

Apache Tomcat Native

Timeline3 articles

Related CVEsby mentions

Appears with

CVE-2026-86247: Apache Tomcat Native: Client certificate requirements can be down-graded

CVE-2026-86246: Apache Tomcat Native: Insecure OpenSSL options enabled

CVE-2026-86243: Apache Tomcat Native: DoS via TLS handshake