PT-2026-97310 · Apache · Tomcat Native

CVE-2026-86246

·

Published

2026-09-23

·

Updated

2026-09-28

CVSS v3.1

9.1

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions Apache Tomcat Native versions 1.3.0 through 1.3.8 Apache Tomcat Native versions 2.0.0 through 2.0.15
Description Apache Tomcat Native enables several insecure OpenSSL options by default. These include ALLOW CLIENT RENEGOTIATION, NO EXTENDED MASTER SECRET, IGNORE UNEXPECTED EOF, and ALLOW NO DHE KEX.
Recommendations Upgrade Apache Tomcat Native versions 1.3.0 through 1.3.8 to version 1.3.9. Upgrade Apache Tomcat Native versions 2.0.0 through 2.0.15 to version 2.0.16.

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-1188

Related Identifiers

CVE-2026-86246
OPENSUSE-SU-2026:11898-1
OPENSUSE-SU-2026:11899-1

Affected Products

Tomcat Native