CVE-2026-86246

EUVD-2026-85268

23.09.2026, 13:17

Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX.

This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier unsupported versions may also be affected.

Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fix the issue.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
apache	CNA	9.1 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
apache	tomcat_native	2.0.0 ≤ 𝑥 ≤ 2.0.15	CNA
apache	tomcat_native	1.3.0 ≤ 𝑥 ≤ 1.3.8	CNA

Debian Releases

Debian Product

Codename

tomcat-native

bookworm	vulnerable
forky	2.0.16-1 fixed
sid	2.0.16-1 fixed
trixie	vulnerable

Common Weakness Enumeration

CWE-1188 - Insecure Default Initialization of Resource
The software initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.

References

https://lists.apache.org/thread/dgyvfwb24nbk45ptvlhdyhdhl5o7k5ol

http://www.openwall.com/lists/oss-security/2026/09/23/32