CVE-2026-86246
Apache Tomcat Native: insecure OpenSSL options enabled by default
Technology
Apache Tomcat Native
CVSS Score
9.1 / 10.0
Affected Versions
Tomcat Native 2.0.0 to 2.0.15; 1.3.0 to 1.3.8; earlier unsupported versions may also be affected
Upstream Fix
Tomcat Native 2.0.16; 1.3.9
Published
September 23, 2026
OSSeva Coverage
Fixed upstream
Description
Tomcat Native enabled insecure OpenSSL options by default, including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX. Made public on 23 September 2026 and rated Moderate by the Tomcat security team. Fixed in Tomcat Native 2.0.16 and 1.3.9.
Is your Apache Tomcat Native deployment affected?
If you're running Tomcat Native 2.0.0 to 2.0.15; 1.3.0 to 1.3.8; earlier unsupported versions may also be affected, you need this patch. Book a discovery call to get covered.
Get a quote
Running Apache Tomcat Native Tomcat Native 2.0.0 to 2.0.15; 1.3.0 to 1.3.8; earlier unsupported versions may also be affected?
Send your work email and a senior engineer will tell you whether this CVE applies to your versions and who patches it. Reply within 1 business day.
Prefer to talk or read more first?