Tomcat Native vulnerabilities | LiveThreat CVE Feed — Verisq

Login Request a demo

TN

Product

Tomcat Native

by Apache · last CVE Sep 23, 2026

8

CVEs

0

On KEV

9.1

Max CVSS

0

New 30D

Vulnerabilities8 In the news0 Timeline

Severity mix

Critical 2High 5Medium 1Low 0

Severity

All severities8 Critical2 High5 Medium1 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Tomcat Native to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-86243	7.5	1%	Sep 23	Apache Tomcat Native: DoS via TLS handshake Affected: 1.3.0 before 1.3.9; 2.0.0 before 2.0.16
CVE-2026-24734	7.5	1%	Feb 17	Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat Affected: 1.3.0 before 1.3.5; 2.0.0 before 2.0.12
CVE-2026-86247	7.4	0%	Sep 23	Apache Tomcat Native: Client certificate requirements can be down-graded Affected: 1.3.0 before 1.3.9; 2.0.0 before 2.0.16
CVE-2018-8020	7.4	4%	Jul 31	Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 has a flaw that does not properly check OCSP pre-produced responses, which are lists (multiple entries) of certificate… Affected: 1.1.23 through 1.1.34; 1.2.0 through 1.2.16
CVE-2018-8019	7.4	4%	Jul 31	When using an OCSP responder Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 did not correctly handle invalid responses Affected: 1.1.23 through 1.1.34; 1.2.0 through 1.2.16