9.1

CVE-2026-86246

Apache Tomcat Native: Insecure OpenSSL options enabled

Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default  including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX.



This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier unsupported versions may also be affected.



Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fix the issue.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apache ≫ Tomcat Native Version >= 1.3.0 < 1.3.9
Apache ≫ Tomcat Native Version >= 2.0.0 < 2.0.16
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.28% 0.181
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
CISA-ADP 9.1 3.9 5.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-1188 Initialization of a Resource with an Insecure Default

The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

https://lists.apache.org/thread/dgyvfwb24nbk45ptvlhdyhdhl5o7k5ol
Vendor Advisory
Mailing List
http://www.openwall.com/lists/oss-security/2026/09/23/32
Third Party Advisory
Mailing List