CVE-2026-86247
HighCVSS 7.4Summary
A race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations. Affects versions from 2.0.0 through 2.0.15 and from 1.3.0 through 1.3.8.
Risk Assessment
This may allow acceptance of invalid client certificates, weakening TLS mutual authentication security.
Recommendation
Upgrade Apache Tomcat Native to version 2.0.16 or 1.3.9, which fix the issue.
Other vulnerabilities in Apache Tomcat Native
See all- CVE-2026-86243High
A buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. Affects versions from 2.0.0 through 2.0.15 and from 1.3.0 through 1.3.8.
- CVE-2026-86246Critical
Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fix the issue.
- CVE-2026-24734High
Improper input validation vulnerability in Apache Tomcat Native and Apache Tomcat when using an OCSP responder. The lack of complete verification and freshness checks on OCSP responses allows certificate revocation to be bypassed.
Original NVD description (English source)
Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be affected. Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fixes the issue.