CVE-2026-29145-Everything

CVE-2026-29145 Everything Apache Tomcat CLIENTCERT + OCSP soft-fail bypass complete reproduction environment, exploit traffic captures, and Suricata detection rule writing materials. For authorized security research and detection rule development only. Do not use on unauthorized systems...

Astra Linux – Vulnerability in Tomcat9

There is a vulnerability related to improper input validation in Apache Tomcat Native and Apache Tomcat. When using an OCSP responder, Apache Tomcat Native and Tomcat’s FFM port of the Apache Tomcat Native code failed to perform verification or freshness checks on the OCSP response, allowing...

K000163720: Apache Tomcat vulnerabilities CVE-2026-86243, CVE-2026-86246, and CVE-2026-86247

Security Advisory Description CVE-2026-86243 Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupporte...

Amazon Linux 2023 : tomcat-native (ALAS2023-2026-3167)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3167 advisory. Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects Apache Tomcat Native: from 2.0.0...

Important: tomcat-native

Issue Overview: Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versions may also be...

Updated tomcat-native package fixes security vulnerabilities

DoS via TLS handshake. CVE-2026-86243 Insecure OpenSSL options enabled. CVE-2026-86246 Client certificate requirements can be down-graded. CVE-2026-86247...

MGASA-2026-0476 Updated tomcat-native package fixes security vulnerabilities

DoS via TLS handshake. CVE-2026-86243 Insecure OpenSSL options enabled. CVE-2026-86246 Client certificate requirements can be down-graded. CVE-2026-86247...

CVE-2026-86246

A flaw was found in Apache Tomcat Native, which enabled several insecure OpenSSL options by default: ALLOWCLIENTRENEGOTIATION, NOEXTENDEDMASTERSECRET, IGNOREUNEXPECTEDEOF, and ALLOWNODHEKEX. These defaults can weaken TLS protections. Apache Tomcat Native versions 1.3.0 through 1.3.8 and 2.0.0...

CVE-2026-86243

A flaw was found in Apache Tomcat Native. A remote attacker can exploit a buffer over-read vulnerability during the Transport Layer Security TLS handshake. Successful exploitation causes the Java Virtual Machine JVM to crash, resulting in a denial of service DoS. Mitigation Upgrade Apache Tomcat...

Rocky Linux 9.6 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (ALMALINUX9.6:CLSA-2026:1774442729)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1774442729 advisory. - Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP responder, Tomcat Native and Tomcat's...

AlmaLinux 9.6 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc (ALMALINUX9.6:CLSA-2026:1774442729)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1774442729 advisory. - Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP responder, Tomcat Native and Tomcat's FF...

CVE-2026-86247

A flaw was found in Apache Tomcat Native. A race condition within a thread allows client certificate verification requirements to be down-graded for certain configurations. This could enable an attacker to bypass stricter authentication requirements, potentially leading to unauthorized access or...

SUSE CVE-2026-86243

Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versions may also be affected. Users are...

SUSE CVE-2026-86246

Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOWCLIENTRENEGOTIATION, NOEXTENDEDMASTERSECRET, IGNOREUNEXPECTEDEOF and ALLOWNODHEKEX. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, fr...

SUSE CVE-2026-86247

Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be...

Linux Distros Unpatched Vulnerability : CVE-2026-86246

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including...

Linux Distros Unpatched Vulnerability : CVE-2026-86247

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some...

Linux Distros Unpatched Vulnerability : CVE-2026-86243

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects...

CVE-2026-86247

Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be...

CVE-2026-86246

Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOWCLIENTRENEGOTIATION, NOEXTENDEDMASTERSECRET, IGNOREUNEXPECTEDEOF and ALLOWNODHEKEX. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, fr...