High severity7.5NVD Advisory· Published Sep 23, 2026· Updated Oct 6, 2026

CVE-2026-86243

Description

Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash.

This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versions may also be affected.

Users are recommended to upgrade to version 1.3.9 or 2.0.16, which fix the issue.

LLM-synthesized narrative grounded in this CVE's description and references.

Apache/Tomcat Native2 versions
cpe:2.3:a:apache:tomcat_native:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:apache:tomcat_native:*:*:*:*:*:*:*:*range: >=1.3.0,<1.3.9
- (no CPE)range: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8
osv-coords7 versions
pkg:rpm/opensuse/libtcnative-1-0&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/libtcnative-1-0&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/libtcnative-2-0&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/libtcnative-2-0&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/tomcat&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/tomcat10&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/tomcat11&distro=openSUSE%20Leap%2016.0
< 1.3.9-160000.1.1+ 6 more
- (no CPE)range: < 1.3.9-160000.1.1
- (no CPE)range: < 1.3.9-1.1
- (no CPE)range: < 2.0.16-160000.1.1
- (no CPE)range: < 2.0.16-1.1
- (no CPE)range: < 9.0.122-160000.1.1
- (no CPE)range: < 10.1.60-160000.1.1
- (no CPE)range: < 11.0.26-160000.1.1