CVE-2026-86243
Received Received - Intake

Buffer Over-Read in Apache Tomcat Native TLS Handshake

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: Apache Software Foundation

Description
Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versions may also be affected. Users are recommended to upgrade to version 1.3.9 or 2.0.16, which fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-86243
EUVD
EUVD-2026-85267

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
apache tomcat_native From 1.3.0 (inc) to 1.3.8 (inc)
apache tomcat_native From 2.0.0 (inc) to 2.0.15 (inc)
apache tomcat_native 1.3.9
apache tomcat_native 2.0.16

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-126 The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake. It allows a malicious user to cause a denial of service by crashing the JVM.

Detection Guidance

Detecting this vulnerability requires checking the version of Apache Tomcat Native. Run 'java -jar tomcat-native.jar -version' or check the library file directly. If the version is between 1.3.0-1.3.8 or 2.0.0-2.0.15, the system is vulnerable.

Impact Analysis

The vulnerability can lead to system crashes, disrupting services that rely on Apache Tomcat Native for TLS handshakes. This may cause downtime and affect availability of applications.

Compliance Impact

This vulnerability is a buffer over-read in Apache Tomcat Native during TLS handshakes, causing JVM crashes. It does not directly affect compliance with GDPR, HIPAA, or similar standards, as it is a denial-of-service issue rather than a data exposure or privacy violation.

Mitigation Strategies

Upgrade Apache Tomcat Native to version 1.3.9 or 2.0.16 immediately. If using a package manager, run 'apt-get upgrade libtcnative-1' or equivalent. Restart Tomcat after upgrading to apply changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86243. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart