CVE-2026-86247
Received Received - Intake

Race Condition in Apache Tomcat Native Allows Certificate Bypass

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: Apache Software Foundation

Description
Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be affected. Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-86247
EUVD
EUVD-2026-85270

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
apache tomcat_native From 2.0.0 (inc) to 2.0.15 (inc)
apache tomcat_native From 1.3.0 (inc) to 1.3.8 (inc)
apache tomcat_native 2.0.16
apache tomcat_native 1.3.9

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-366 If two threads of execution use a resource simultaneously, there exists the possibility that resources may be used while invalid, in turn making the state of execution undefined.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a race condition in Apache Tomcat Native that allows client certificate verification requirements to be downgraded for certain configurations. This means an attacker could exploit timing issues to bypass intended security checks.

Detection Guidance

This vulnerability is specific to Apache Tomcat Native versions 2.0.0 through 2.0.15 and 1.3.0 through 1.3.8. Detection involves checking the installed version of Apache Tomcat Native. Use commands like 'find / -name tomcat-native*' or 'ldd <path-to-tomcat>/lib/libtcnative-1.so | grep version' to identify the version. If the version falls within the affected range, the system is vulnerable.

Impact Analysis

If exploited, this could allow unauthorized access to protected resources by bypassing certificate verification. Systems relying on client certificates for authentication may be compromised, leading to potential data breaches or unauthorized actions.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by allowing unauthorized access to sensitive data. Organizations may fail to meet requirements for strong authentication and data protection if client certificate verification is bypassed.

Mitigation Strategies
  • Upgrade Apache Tomcat Native to version 2.0.16 or 1.3.9 or later to address the race condition vulnerability.
  • Review configurations to ensure client certificate verification requirements cannot be downgraded.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86247. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart