tomcat-native: Apache Tomcat Native: Denial of Service via buffer over-read during TLS handshake

A flaw was found in Apache Tomcat Native. A remote attacker can exploit a buffer over-read vulnerability during the Transport Layer Security TLS handshake. Successful exploitation causes the Java Virtual Machine JVM to crash, resulting in a denial of service DoS...

tomcat-native: Apache Tomcat Native: Weakened TLS connection security via insecure default configuration

A flaw was found in Apache Tomcat Native, which enabled several insecure OpenSSL options by default: ALLOWCLIENTRENEGOTIATION, NOEXTENDEDMASTERSECRET, IGNOREUNEXPECTEDEOF, and ALLOWNODHEKEX. These defaults can weaken TLS protections. Apache Tomcat Native versions 1.3.0 through 1.3.8 and 2.0.0...

tomcat-native: Apache Tomcat Native: Client certificate verification requirements can be down-graded via race condition

A flaw was found in Apache Tomcat Native. A race condition within a thread allows client certificate verification requirements to be down-graded for certain configurations. This could enable an attacker to bypass stricter authentication requirements, potentially leading to unauthorized access or...

tomcat-native: Apache Tomcat Native: Client certificate verification requirements can be down-graded via race condition

A flaw was found in Apache Tomcat Native. A race condition within a thread allows client certificate verification requirements to be down-graded for certain configurations. This could enable an attacker to bypass stricter authentication requirements, potentially leading to unauthorized access or...

tomcat-native: Apache Tomcat Native: Denial of Service via buffer over-read during TLS handshake

A flaw was found in Apache Tomcat Native. A remote attacker can exploit a buffer over-read vulnerability during the Transport Layer Security TLS handshake. Successful exploitation causes the Java Virtual Machine JVM to crash, resulting in a denial of service DoS...

tomcat-native: Apache Tomcat Native: Weakened TLS connection security via insecure default configuration

A flaw was found in Apache Tomcat Native, which enabled several insecure OpenSSL options by default: ALLOWCLIENTRENEGOTIATION, NOEXTENDEDMASTERSECRET, IGNOREUNEXPECTEDEOF, and ALLOWNODHEKEX. These defaults can weaken TLS protections. Apache Tomcat Native versions 1.3.0 through 1.3.8 and 2.0.0...

CLEANSTART-2026-XV28553 CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native

Security vulnerability affects the thingsboard package. CLIENTCERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native...

CLEANSTART-2026-KU46042 Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat

Security vulnerability affects the thingsboard package. Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat...

Amazon Linux 2 : tomcat-native (ALAS-2026-4058)

The version of tomcat-native installed on the remote host is prior to 1.2.38-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4058 advisory. Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS vi...

Amazon Linux 2 : tomcat-native (ALAS-2026-4016)

The version of tomcat-native installed on the remote host is prior to 1.2.38-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4016 advisory. Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to...

K000163720: Apache Tomcat vulnerabilities CVE-2026-86243, CVE-2026-86246, and CVE-2026-86247

Security Advisory Description CVE-2026-86243 Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupporte...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: tomcat (UTSA-2026-130104)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130104 advisory. CLIENTCERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native. This issue...

Amazon Linux 2023 : tomcat-native (ALAS2023-2026-3167)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3167 advisory. Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects Apache Tomcat Native: from 2.0.0...

Important: tomcat-native

Issue Overview: Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versions may also be...

CVE-2026-86246

A flaw was found in Apache Tomcat Native, which enabled several insecure OpenSSL options by default: ALLOWCLIENTRENEGOTIATION, NOEXTENDEDMASTERSECRET, IGNOREUNEXPECTEDEOF, and ALLOWNODHEKEX. These defaults can weaken TLS protections. Apache Tomcat Native versions 1.3.0 through 1.3.8 and 2.0.0...

CVE-2026-86243

A flaw was found in Apache Tomcat Native. A remote attacker can exploit a buffer over-read vulnerability during the Transport Layer Security TLS handshake. Successful exploitation causes the Java Virtual Machine JVM to crash, resulting in a denial of service DoS. Mitigation Upgrade Apache Tomcat...

AlmaLinux 9.6 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (ALMALINUX9.6:CLSA-2026:1774442729)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1774442729 advisory. - Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP responder, Tomcat Native and Tomcat's FF...

Rocky Linux 9.6 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (ALMALINUX9.6:CLSA-2026:1774442729)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1774442729 advisory. - Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP responder, Tomcat Native and Tomcat's...

CVE-2026-86247

A flaw was found in Apache Tomcat Native. A race condition within a thread allows client certificate verification requirements to be down-graded for certain configurations. This could enable an attacker to bypass stricter authentication requirements, potentially leading to unauthorized access or...

SUSE CVE-2026-86243

Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versions may also be affected. Users are...