CVE-2026-86243

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-86243
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86243.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-86243
Downstream
DEBIAN (1)
MGASA (1)
MINI (1)
openSUSE (3)
SUSE (4)
UBUNTU (1)
Related
openSUSE (3)
SUSE (4)
Published
2026-09-23T12:24:55Z
Modified
2026-10-24T10:30:21Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Apache Tomcat Native: DoS via TLS handshake
Details

Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash.

This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versions may also be affected.

Users are recommended to upgrade to version 1.3.9 or 2.0.16, which fix the issue.

Database specific 
{
    "cna_assigner":  "apache",
    "cwe_ids":  [
        "CWE-126"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86243.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "2.0.0"
                        },
                        {
                            "last_affected":  "2.0.15"
                        },
                        {
                            "introduced":  "1.3.0"
                        },
                        {
                            "last_affected":  "1.3.8"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "StandardRange"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/apache/tomcat-native

Affected ranges

Type
GIT
Repo
https://github.com/apache/tomcat-native
Events
Introduced
39c19afe4a3df7ea4fda778d82dc25bd494a110c
Last Affected
1ac2db19bf68287b527d166128ab0d62d0d4097a
Introduced
998746966815e1ae105cba9f2681d37cc30249bc
Last Affected
8c61da2f325763f65214bdb4876641cbe31a2f0f
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "2.0.0"
                },
                {
                    "last_affected":  "2.0.15"
                }
            ],
            "source":  "DESCRIPTION"
        },
        {
            "range":  [
                {
                    "introduced":  "1.3.0"
                },
                {
                    "last_affected":  "1.3.8"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86243.json"