Vulnerabilitymedium
CVE-2026-86246: Apache Tomcat Native: Insecure OpenSSL options enabled
AI summary · grok-4.7Summaries by Vani AI
Apache Tomcat Native enables insecure OpenSSL options by default, tracked as CVE-2026-86246.
Mark Thomas disclosed CVE-2026-86246, rated moderate, in Apache Tomcat Native. Versions 2.0.0 through 2.0.15 and 1.3.0 through 1.3.8 initialize TLS with insecure OpenSSL defaults, including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF, and ALLOW_NO_DHE_KEX. The oss-security post does not describe active exploitation.
Key facts
- Moderate-severity insecure OpenSSL defaults in Tomcat Native
- Affects 1.3.0–1.3.8 and 2.0.0–2.0.15
- Options include client renegotiation and no extended master secret
- No in-the-wild exploitation is reported
- CVEs
- CVE-2026-86246
- Vendors
- Apache
- Products
- Apache Tomcat Native
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-86246 | Insecure TLS defaults in Apache Tomcat Native enable man-in-the-middle decryption | 9.1 | — |
From the original article
Posted by Mark Thomas on Sep 23 Severity: moderate Affected versions: - Apache Tomcat Native 2. 0. 0 through 2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.