High severity7.4NVD Advisory· Published Sep 23, 2026· Updated Oct 6, 2026
CVE-2026-86247
CVE-2026-86247
Description
Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations.
This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be affected.
Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fixes the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
9cpe:2.3:a:apache:tomcat_native:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:apache:tomcat_native:*:*:*:*:*:*:*:*range: >=1.3.0,<1.3.9
- (no CPE)range: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8
- osv-coords7 versionspkg:rpm/opensuse/libtcnative-1-0&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/libtcnative-1-0&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/libtcnative-2-0&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/libtcnative-2-0&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/tomcat&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/tomcat10&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/tomcat11&distro=openSUSE%20Leap%2016.0
< 1.3.9-160000.1.1+ 6 more
- (no CPE)range: < 1.3.9-160000.1.1
- (no CPE)range: < 1.3.9-1.1
- (no CPE)range: < 2.0.16-160000.1.1
- (no CPE)range: < 2.0.16-1.1
- (no CPE)range: < 9.0.122-160000.1.1
- (no CPE)range: < 10.1.60-160000.1.1
- (no CPE)range: < 11.0.26-160000.1.1
Patches
Vulnerability mechanics
References
2- www.openwall.com/lists/oss-security/2026/09/23/33nvdMailing ListThird Party Advisory
- lists.apache.org/thread/obsson6zhvfg0wsp2bx602l61ltj87r1nvdVendor Advisory
News mentions
1- Apache: 25 Vulnerabilities Disclosed, Critical Flaws Hit Tomcat on Sep 23-24, 2026Vypr Intelligence · Sep 24, 2026