CVE-2026-86247: Apache Tomcat Native: Client certificate requirements can be down-graded

Apache Tomcat Native (tc-native), the optional JNI library that lets Tomcat's APR/native connector use OpenSSL, contains a thread-level race condition (CWE-366) that can cause client certificate verification requirements to be downgraded for some configurations. If the race is won during TLS handshake processing, a server configured to require a valid client certificate (mutual TLS) may accept a connection without proper certificate verification, allowing an unauthenticated remote attacker to reach or impersonate clients on an endpoint that should have been protected. The flaw affects Tomcat Native 1.3.0 through 1.3.8 and 2.0.0 through 2.0.15, and unsupported older versions may also be affected; exploitation requires a vulnerable connector configuration plus favorable timing (reflected in the high attack-complexity CVSS score of 7.4). The impact is on confidentiality and integrity of mutually authenticated services, not availability. No public proof of concept is known, the issue is not on CISA's KEV list, and there are no reports of exploitation in the wild.