7.5

CVE-2026-86243

Apache Tomcat Native: DoS via TLS handshake

Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash.



This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versions may also be affected.



Users are recommended to upgrade to version 1.3.9 or 2.0.16, which fix the issue.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apache ≫ Tomcat Native Version >= 1.3.0 < 1.3.9
Apache ≫ Tomcat Native Version >= 2.0.0 < 2.0.16
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.4% 0.311
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
CISA-ADP 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-126 Buffer Over-read

The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.

https://lists.apache.org/thread/8p4jf02w54m22x0cwpq2x53w3ov8o557
Vendor Advisory
Mailing List
http://www.openwall.com/lists/oss-security/2026/09/23/31
Third Party Advisory
Mailing List