CVE-2026-86243

Published: Sep 23, 2026Modified: Oct 6, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versions may also be affected. Users are recommended to upgrade to version 1.3.9 or 2.0.16, which fix the issue.

Affected (2)

Products: Apache: Tomcat Native

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Apache Tomcat Native	1.3.0 ≤ version < 1.3.9
Apache Tomcat Native	2.0.0 ≤ version < 2.0.16

Related CWEs

Buffer Over-read

The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.

References (2)

https://lists.apache.org/thread/8p4jf02w54m22x0cwpq2x53w3ov8o557

Source: security@apache.org

Vendor AdvisoryMailing List

http://www.openwall.com/lists/oss-security/2026/09/23/31

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

Timeline

No history available yet.