Apache Tomcat Native
8 CVEs affecting Apache Tomcat Native. Latest disclosed: 2026-09-23. Critical: 2, High: 5.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-86246 | Critical | 9.1 | 2026-09-23 | Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOT… |
CVE-2026-29145 | Critical | 9.1 | 2026-04-09 | CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native. This… |
CVE-2026-86243 | High | 7.5 | 2026-09-23 | Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affect… |
CVE-2026-24734 | High | 7.5 | 2026-02-17 | Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomc… |
CVE-2026-86247 | High | 7.4 | 2026-09-23 | Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurat… |
CVE-2018-8020 | High | 7.4 | 2018-07-31 | Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 has a flaw that does not properly check OCSP pre-produced responses, which are lists (multiple entrie… |
CVE-2018-8019 | High | 7.4 | 2018-07-31 | When using an OCSP responder Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 did not correctly handle invalid responses. This allowed for revoked cli… |
CVE-2017-15698 | Medium | 5.9 | 2018-01-31 | When parsing the AIA-Extension field of a client certificate, Apache Tomcat Native Connector 1.2.0 to 1.2.14 and 1.1.23 to 1.1.34 did not correctly handle fiel… |