CVE-2026-86243 — HIGH (7.5)

Q: How severe is CVE-2026-86243?

CVE-2026-86243 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2026-86243?

Check the references section above for vendor advisories and patch information. Affected products include: Apache Tomcat Native.

Vulnerability Description

Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versions may also be affected. Users are recommended to upgrade to version 1.3.9 or 2.0.16, which fix the issue.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Affected Products

Vendor	Product	Versions
Apache	Tomcat Native	>= 1.3.0, < 1.3.9

Related Weaknesses (CWE)

CWE-126

References

https://lists.apache.org/thread/8p4jf02w54m22x0cwpq2x53w3ov8o557Vendor AdvisoryMailing List
http://www.openwall.com/lists/oss-security/2026/09/23/31Mailing ListThird Party Advisory

FAQ

What is CVE-2026-86243?

CVE-2026-86243 is a vulnerability with a CVSS score of 7.5 (HIGH). Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects Apache Tomcat Native: from 2.0.0 throug...

How severe is CVE-2026-86243?

CVE-2026-86243 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-86243?

Check the references section above for vendor advisories and patch information. Affected products include: Apache Tomcat Native.