CVE-2026-86246
CriticalCVSS 9.1Summary
Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fix the issue.
Risk Assessment
Insecure default options can weaken TLS connection security, enabling man-in-the-middle attacks, cipher downgrade, or unauthorized access.
Recommendation
It is recommended to upgrade Apache Tomcat Native to version 2.0.16 or 1.3.9, which include the fix.
Other vulnerabilities in Apache Tomcat Native
See all- CVE-2026-86247High
A race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations. Affects versions from 2.0.0 through 2.0.15 and from 1.3.0 through 1.3.8.
- CVE-2026-86243High
A buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. Affects versions from 2.0.0 through 2.0.15 and from 1.3.0 through 1.3.8.
- CVE-2026-24734High
Improper input validation vulnerability in Apache Tomcat Native and Apache Tomcat when using an OCSP responder. The lack of complete verification and freshness checks on OCSP responses allows certificate revocation to be bypassed.
Original NVD description (English source)
Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier unsupported versions may also be affected. Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fix the issue.