Skip to content
CVE PROGRAM SOURCE RECORD9.1 Critical

CVE-2026-86246

Apache Tomcat Native: Insecure OpenSSL options enabled

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier unsupported versions may also be affected. Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fix the issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache Tomcat Native

Default version status: unaffected

  • 2.0.0 to ≤ 2.0.15affected
  • 1.3.0 to ≤ 1.3.8affected

References