CVE-2026-86243
published 2026-09-23CVE-2026-86243: Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects…
PriorityP345high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.60%
48.3th percentile
Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash.
This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versions may also be affected.
Users are recommended to upgrade to version 1.3.9 or 2.0.16, which fix the issue.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tomcat_native | >= 1.3.0 < 1.3.9 | 1.3.9 |
| apache | tomcat_native | >= 2.0.0 < 2.0.16 | 2.0.16 |
| apache_software_foundation | apache_tomcat_native | 1.3.0 – 1.3.8 | — |
| apache_software_foundation | apache_tomcat_native | 2.0.0 – 2.0.15 | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash.
ghsa_unreviewed·2026-09-23
CVE-2026-86243 [HIGH] CWE-126 Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash.
Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash.
This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versions may also be affected.
Users are recommended to upgrade to version 1.3.9 or 2.0.16, which fix the issue.
Red Hat
tomcat-native: Apache Tomcat Native: Denial of Service via buffer over-read during TLS handshake
vendor_redhat·2026-09-23·CVSS 7.5
CVE-2026-86243 [HIGH] CWE-126 tomcat-native: Apache Tomcat Native: Denial of Service via buffer over-read during TLS handshake
tomcat-native: Apache Tomcat Native: Denial of Service via buffer over-read during TLS handshake
Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash.
This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versions may also be affected.
Users are recommended to upgrade to version 1.3.9 or 2.0.16, which fix the issue.
A flaw was found in Apache Tomcat Native. A remote attacker can exploit a buffer over-read vulnerability during the Transport Layer Security (TLS) handshake. Successful exploitation causes the Java Virtual Machine (JVM) to crash, resulting in a denial of service (DoS).
Statement: Red Hat rates this flaw as Important. An unauthentic
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-86243 tomcat-native: Apache Tomcat Native: Denial of Service via buffer over-read during TLS handshake [epel-all]
bugzilla·2026-10-08·CVSS 7.5
CVE-2026-86243 [HIGH] CVE-2026-86243 tomcat-native: Apache Tomcat Native: Denial of Service via buffer over-read during TLS handshake [epel-all]
CVE-2026-86243 tomcat-native: Apache Tomcat Native: Denial of Service via buffer over-read during TLS handshake [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash.
This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versions may also be affected.
Users are recommended to upgrade to version 1.3.9 or 2.0.16, which fix the issue.
Bugzilla
CVE-2026-86243 tomcat-native: Apache Tomcat Native: Denial of Service via buffer over-read during TLS handshake [fedora-all]
bugzilla·2026-10-08·CVSS 7.5
CVE-2026-86243 [HIGH] CVE-2026-86243 tomcat-native: Apache Tomcat Native: Denial of Service via buffer over-read during TLS handshake [fedora-all]
CVE-2026-86243 tomcat-native: Apache Tomcat Native: Denial of Service via buffer over-read during TLS handshake [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash.
This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versions may also be affected.
Users are recommended to upgrade to version 1.3.9 or 2.0.16, which fix the issue.
Bugzilla
CVE-2026-86243 tomcat-native: Apache Tomcat Native: Denial of Service via buffer over-read during TLS handshake
bugzilla·2026-09-23·CVSS 7.5
CVE-2026-86243 [HIGH] CVE-2026-86243 tomcat-native: Apache Tomcat Native: Denial of Service via buffer over-read during TLS handshake
CVE-2026-86243 tomcat-native: Apache Tomcat Native: Denial of Service via buffer over-read during TLS handshake
Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash.
This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versions may also be affected.
Users are recommended to upgrade to version 1.3.9 or 2.0.16, which fix the issue.
2026-09-23
Published