TN
Product
Tomcat Native
8
CVEs
0
On KEV
9.1
Max CVSS
0
New 30D
Severity mix
Critical 2High 5Medium 1Low 0
Watch
Add Tomcat Native to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-86246 | 9.1 | Sep 23 | Apache Tomcat Native: Insecure OpenSSL options enabled Affected: 1.3.0 before 1.3.9; 2.0.0 before 2.0.16 |
| CVE-2026-29145 | 9.1 | Apr 9 | Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled Affected: 1.1.23 before 1.3.7; 2.0.0 before 2.0.14 |
| CVE-2026-86243 | 7.5 | Sep 23 | Apache Tomcat Native: DoS via TLS handshake Affected: 1.3.0 before 1.3.9; 2.0.0 before 2.0.16 |
| CVE-2026-24734 | 7.5 | Feb 17 | Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat Affected: 1.3.0 before 1.3.5; 2.0.0 before 2.0.12 |
| CVE-2026-86247 | 7.4 | Sep 23 | Apache Tomcat Native: Client certificate requirements can be down-graded Affected: 1.3.0 before 1.3.9; 2.0.0 before 2.0.16 |
| CVE-2018-8020 | 7.4 | Jul 31 | Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 has a flaw that does not properly check OCSP pre-produced responses, which are lists (multiple entries) of certificate… Affected: 1.1.23 through 1.1.34; 1.2.0 through 1.2.16 |
| CVE-2018-8019 | 7.4 | Jul 31 | When using an OCSP responder Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 did not correctly handle invalid responses Affected: 1.1.23 through 1.1.34; 1.2.0 through 1.2.16 |
| CVE-2017-15698 | 5.9 | Jan 31 | When parsing the AIA-Extension field of a client certificate, Apache Tomcat Native Connector 1.2.0 to 1.2.14 and 1.1.23 to 1.1.34 did not correctly handle fields longer than 127… Affected: 1.1.23 through 1.1.34; 1.2.0 through 1.2.14 |
Showing 8