High severity · published Sep 23, 2026
CVE-2026-86243
Apache Tomcat Native: DoS via TLS handshake
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash.
This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versions may also be affected.
Users are recommended to upgrade to version 1.3.9 or 2.0.16, which fix the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AT
Apache Tomcat Native · Apache Software Foundation
2.0.0 through 2.0.15; 1.3.0 through 1.3.8 · source: vendor
TN
Tomcat Native · Apache
1.3.0 before 1.3.9; 2.0.0 before 2.0.16 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-86243
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-86243
Vendor Advisory
https://lists.apache.org/thread/8p4jf02w54m22x0cwpq2x53w3ov8o557
Mailing List
http://www.openwall.com/lists/oss-security/2026/09/23/31
More from Apache Tomcat Native
9.1
CVE-2026-86246
Apache Tomcat Native: Insecure OpenSSL options enabled
9.1
CVE-2026-29145
Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled
7.5
CVE-2026-24734
Apache Tomcat Native, Apache Tomcat: OCSP revocation bypass
7.4
CVE-2026-86247
Apache Tomcat Native: Client certificate requirements can be down-graded