HIGHFixed upstream

CVE-2026-86243

Apache Tomcat Native: denial of service via TLS handshake

Technology

Apache Tomcat Native

CVSS Score

7.5 / 10.0

Affected Versions

Tomcat Native 2.0.0 to 2.0.15; 1.3.0 to 1.3.8; earlier unsupported versions may also be affected

Upstream Fix

Tomcat Native 2.0.16; 1.3.9

Published

September 23, 2026

OSSeva Coverage

Fixed upstream

Description

A buffer over-read in Tomcat Native during the TLS handshake let a malicious user crash the JVM. Made public on 23 September 2026 and rated Important by the Tomcat security team. Fixed in Tomcat Native 2.0.16 and 1.3.9.

Upstream record: NVD · CVE.org

Is your Apache Tomcat Native deployment affected?

If you're running Tomcat Native 2.0.0 to 2.0.15; 1.3.0 to 1.3.8; earlier unsupported versions may also be affected, you need this patch. Book a discovery call to get covered.

Book a discovery call View Apache Tomcat Native coverage →

Get a quote

Running Apache Tomcat Native Tomcat Native 2.0.0 to 2.0.15; 1.3.0 to 1.3.8; earlier unsupported versions may also be affected?

Send your work email and a senior engineer will tell you whether this CVE applies to your versions and who patches it. Reply within 1 business day.

Prefer to talk or read more first?

Book a 15-minute call Apache Tomcat Native support