CVE-2026-86246

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-86246
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86246.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-86246
Downstream
DEBIAN (1)
MGASA (1)
MINI (1)
openSUSE (3)
SUSE (4)
UBUNTU (1)
Related
openSUSE (3)
SUSE (4)
Published
2026-09-23T12:26:40Z
Modified
2026-10-24T10:30:47Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Apache Tomcat Native: Insecure OpenSSL options enabled
Details

Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX.

This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier unsupported versions may also be affected.

Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fix the issue.

Database specific 
{
    "cna_assigner":  "apache",
    "cwe_ids":  [
        "CWE-1188"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86246.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "2.0.0"
                        },
                        {
                            "last_affected":  "2.0.15"
                        },
                        {
                            "introduced":  "1.3.0"
                        },
                        {
                            "last_affected":  "1.3.8"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "StandardRange"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/apache/tomcat-native

Affected ranges

Type
GIT
Repo
https://github.com/apache/tomcat-native
Events
Introduced
39c19afe4a3df7ea4fda778d82dc25bd494a110c
Last Affected
1ac2db19bf68287b527d166128ab0d62d0d4097a
Introduced
998746966815e1ae105cba9f2681d37cc30249bc
Last Affected
8c61da2f325763f65214bdb4876641cbe31a2f0f
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "2.0.0"
                },
                {
                    "last_affected":  "2.0.15"
                }
            ],
            "source":  "DESCRIPTION"
        },
        {
            "range":  [
                {
                    "introduced":  "1.3.0"
                },
                {
                    "last_affected":  "1.3.8"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86246.json"