Apache Tomcat Native vulnerabilities
4 known CVE vulnerabilities in Apache Tomcat Native, translated and rated.
- CVE-2026-86247High
A race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations. Affects versions from 2.0.0 through 2.0.15 and from 1.3.0 through 1.3.8.
- CVE-2026-86243High
A buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. Affects versions from 2.0.0 through 2.0.15 and from 1.3.0 through 1.3.8.
- CVE-2026-86246Critical
Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fix the issue.
- CVE-2026-24734High
Improper input validation vulnerability in Apache Tomcat Native and Apache Tomcat when using an OCSP responder. The lack of complete verification and freshness checks on OCSP responses allows certificate revocation to be bypassed.