CVE-2026-86246
published 2026-09-23CVE-2026-86246: Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including…
PriorityP357critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
0.36%
28.7th percentile
Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX.
This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier unsupported versions may also be affected.
Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fix the issue.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tomcat_native | >= 1.3.0 < 1.3.9 | 1.3.9 |
| apache | tomcat_native | >= 2.0.0 < 2.0.16 | 2.0.16 |
| apache_software_foundation | apache_tomcat_native | 1.3.0 – 1.3.8 | — |
| apache_software_foundation | apache_tomcat_native | 2.0.0 – 2.0.15 | — |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
vendor_redhat9.1CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
tomcat-native: Apache Tomcat Native: Weakened TLS connection security via insecure default configuration
vendor_redhat·2026-09-23·CVSS 9.1
CVE-2026-86246 [CRITICAL] CWE-1188 tomcat-native: Apache Tomcat Native: Weakened TLS connection security via insecure default configuration
tomcat-native: Apache Tomcat Native: Weakened TLS connection security via insecure default configuration
Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX.
This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier unsupported versions may also be affected.
Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fix the issue.
A flaw was found in Apache Tomcat Native, which enabled several insecure OpenSSL options by default: ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF, and ALLOW_NO_DHE_KEX. These defaults can weaken TL
GHSA
Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE
ghsa_unreviewed·2026-09-23
CVE-2026-86246 [CRITICAL] CWE-1188 Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE
Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX.
This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier unsupported versions may also be affected.
Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fix the issue.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-86246 tomcat-native: Apache Tomcat Native: Weakened TLS connection security via insecure default configuration [fedora-all]
bugzilla·2026-10-08·CVSS 9.1
CVE-2026-86246 [CRITICAL] CVE-2026-86246 tomcat-native: Apache Tomcat Native: Weakened TLS connection security via insecure default configuration [fedora-all]
CVE-2026-86246 tomcat-native: Apache Tomcat Native: Weakened TLS connection security via insecure default configuration [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX.
This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier unsupported versions may also be affected.
Users are recommended to upgrade to version 2.0.16 or 1
Bugzilla
CVE-2026-86246 tomcat-native: Apache Tomcat Native: Weakened TLS connection security via insecure default configuration [epel-all]
bugzilla·2026-10-08·CVSS 9.1
CVE-2026-86246 [CRITICAL] CVE-2026-86246 tomcat-native: Apache Tomcat Native: Weakened TLS connection security via insecure default configuration [epel-all]
CVE-2026-86246 tomcat-native: Apache Tomcat Native: Weakened TLS connection security via insecure default configuration [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX.
This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier unsupported versions may also be affected.
Users are recommended to upgrade to version 2.0.16 or 1.3
Bugzilla
CVE-2026-86246 tomcat-native: Apache Tomcat Native: Weakened TLS connection security via insecure default configuration
bugzilla·2026-09-23·CVSS 9.1
CVE-2026-86246 [CRITICAL] CVE-2026-86246 tomcat-native: Apache Tomcat Native: Weakened TLS connection security via insecure default configuration
CVE-2026-86246 tomcat-native: Apache Tomcat Native: Weakened TLS connection security via insecure default configuration
Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX.
This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier unsupported versions may also be affected.
Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fix the issue.
2026-09-23
Published