CVE-2026-86243
HighCVSS 7.5Summary
A buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. Affects versions from 2.0.0 through 2.0.15 and from 1.3.0 through 1.3.8.
Risk Assessment
An attacker can cause a JVM crash, leading to denial of service (DoS).
Recommendation
Upgrade Apache Tomcat Native to version 1.3.9 or 2.0.16, which fix the issue.
Other vulnerabilities in Apache Tomcat Native
See all- CVE-2026-86247High
A race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations. Affects versions from 2.0.0 through 2.0.15 and from 1.3.0 through 1.3.8.
- CVE-2026-86246Critical
Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fix the issue.
- CVE-2026-24734High
Improper input validation vulnerability in Apache Tomcat Native and Apache Tomcat when using an OCSP responder. The lack of complete verification and freshness checks on OCSP responses allows certificate revocation to be bypassed.
Original NVD description (English source)
Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versions may also be affected. Users are recommended to upgrade to version 1.3.9 or 2.0.16, which fix the issue.