CVE-2026-85243

CVE-2026-85243 — camel-crypto-pgp: integrity-verification downgrade legacy packet skips the check Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the PGP data format's unmarshal verified the modification detection code only when the message used the OpenPGP...

CVE-2026-85243 Apache Camel: Camel-Crypto-PGP Integrity Verification Downgrade via Attacker-Controlled Message Structure

Improper Validation of Integrity Check Value vulnerability in Apache Camel Crypto PGP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. unmarshal verified the modification detection code only when the message was an OpenPGP symmetrically encrypted...

CVE-2026-85243

The Apache Camel camel-crypto-pgp component is vulnerable to an integrity verification downgrade due to improper validation of integrity check values (CWE-354). The unmarshal() function only verified modification detection codes for specific OpenPGP symmetrically encrypted integrity protected dat...

CVE-2026-85243 Apache Camel: Camel-Crypto-PGP Integrity Verification Downgrade via Attacker-Controlled Message Structure

Improper Validation of Integrity Check Value vulnerability in Apache Camel Crypto PGP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. unmarshal verified the modification detection code only when the message was an OpenPGP symmetrically encrypted...

CVE-2026-85243 Apache Camel: Camel-Crypto-PGP Integrity Verification Downgrade via Attacker-Controlled Message Structure

Improper Validation of Integrity Check Value vulnerability in Apache Camel Crypto PGP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. unmarshal verified the modification detection code only when the message was an OpenPGP symmetrically encrypted...

Exploit for CVE-2026-85243

CVE-2026-85243 — camel-crypto-pgp: integrity-verification down...

Apache Camel 4.22.0 PGP Integrity Verification Downgrade

Apache Camel version 4.22.0 contains an integrity-verification downgrade in camel-crypto-pgp. The proof of concept generates a legacy OpenPGP message without modification detection data and demonstrates that the affected decryptor accepts it. https://packetstorm.news/download/236335...

SUSE-SU-2026:4658-1 Security update for libtcnative-2-0

This update for libtcnative-2-0 fixes the following issues: - CVE-2026-86243: buffer overread during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash bsc1282623. - CVE-2026-86246: insecure ALLOWCLIENTRENEGOTIATION, NOEXTENDEDMASTERSECRET, IGNOREUNEXPECTEDEOF and...

Amazon Linux 2023 : tomcat-native (ALAS2023-2026-3167)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3167 advisory. Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects Apache Tomcat Native: from 2.0.0...

SUSE CVE-2026-86247

Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be...

CVE-2026-86247

Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be...

CVE-2026-86247 Apache Tomcat Native: Client certificate requirements can be down-graded

Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be...

CVE-2026-86247

A race condition within a thread in Apache Tomcat Native allows client certificate verification requirements to be down-graded for certain configurations. This vulnerability affects versions 2.0.0 through 2.0.15 and 1.3.0 through 1.3.8 , with unsupported versions potentially impacted. To remediat...

PT-2026-97311

Name of the Vulnerable Software and Affected Versions Apache Tomcat Native versions 2.0.0 through 2.0.15 Apache Tomcat Native versions 1.3.0 through 1.3.8 Description A race condition within a thread allows client certificate verification requirements to be down-graded in certain configurations...

GHSA-H4FW-6R7F-W494 Webauthn has a User Verification Downgrade via Default-Open ClientOverridePolicy

Summary In version 5.3.0 of the Symfony bundle, Webauthn\Bundle\Policy\ClientOverridePolicy defaulted to allowing all client overrides, including userVerification. A client could send "userVerification": "discouraged" in the assertion or attestation options request to override a server-configured...