CVE-2026-86246

EUVD-2026-85268

23.09.2026, 13:17

Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX.

This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier unsupported versions may also be affected.

Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fix the issue.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	9.1 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 28.46%

Affected Products (NVD)

Vendor	Product	Version
apache	tomcat_native	1.3.0 ≤ 𝑥 < 1.3.9
apache	tomcat_native	2.0.0 ≤ 𝑥 < 2.0.16

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

tomcat-native

bookworm	postponed
forky	2.0.16-1 fixed
sid	2.0.16-1 fixed
trixie	no-dsa

Ubuntu Releases

Ubuntu Product

Codename

tomcat-native

bionic	needs-triage
focal	needs-triage
jammy	needs-triage
noble	needs-triage
resolute	needs-triage
stonking	needs-triage
xenial	needs-triage

openSUSE / SLES Releases

openSUSE Product

Release

libapr1

suse enterprise sap 12 SP5	1.6.5-4.13.1 fixed
suse enterprise server 12 SP5	1.6.5-4.13.1 fixed

libapr1-devel

suse enterprise sap 12 SP5	1.6.5-4.13.1 fixed
suse enterprise server 12 SP5	1.6.5-4.13.1 fixed

libtcnative-1-0

suse enterprise desktop 15 SP7	1.3.9-150600.16.9.2 fixed
suse enterprise sap 12 SP5	1.3.9-3.9.1 fixed
suse enterprise sap 15 SP4	1.3.9-150200.6.11.2 fixed
suse enterprise sap 15 SP5	1.3.9-150200.6.11.2 fixed
suse enterprise sap 15 SP6	1.3.9-150600.16.9.2 fixed
suse enterprise sap 15 SP7	1.3.9-150600.16.9.2 fixed
suse enterprise server 12 SP5	1.3.9-3.9.1 fixed
suse enterprise server 15 SP4	1.3.9-150200.6.11.2 fixed
suse enterprise server 15 SP5	1.3.9-150200.6.11.2 fixed
suse enterprise server 15 SP6	1.3.9-150600.16.9.2 fixed
suse enterprise server 15 SP7	1.3.9-150600.16.9.2 fixed

libtcnative-1-0-devel

suse enterprise sap 12 SP5	1.3.9-3.9.1 fixed
suse enterprise sap 15 SP4	1.3.9-150200.6.11.2 fixed
suse enterprise sap 15 SP5	1.3.9-150200.6.11.2 fixed
suse enterprise sap 15 SP6	1.3.9-150600.16.9.2 fixed
suse enterprise sap 15 SP7	1.3.9-150600.16.9.2 fixed
suse enterprise server 12 SP5	1.3.9-3.9.1 fixed
suse enterprise server 15 SP4	1.3.9-150200.6.11.2 fixed
suse enterprise server 15 SP5	1.3.9-150200.6.11.2 fixed
suse enterprise server 15 SP6	1.3.9-150600.16.9.2 fixed
suse enterprise server 15 SP7	1.3.9-150600.16.9.2 fixed

libtcnative-2-0

suse enterprise desktop 15 SP7	2.0.16-150400.9.6.1 fixed
suse enterprise sap 15 SP4	2.0.16-150400.9.6.1 fixed
suse enterprise sap 15 SP5	2.0.16-150400.9.6.1 fixed
suse enterprise sap 15 SP6	2.0.16-150400.9.6.1 fixed
suse enterprise sap 15 SP7	2.0.16-150400.9.6.1 fixed
suse enterprise server 15 SP4	2.0.16-150400.9.6.1 fixed
suse enterprise server 15 SP5	2.0.16-150400.9.6.1 fixed
suse enterprise server 15 SP6	2.0.16-150400.9.6.1 fixed
suse enterprise server 15 SP7	2.0.16-150400.9.6.1 fixed

libtcnative-2-0-devel

suse enterprise sap 15 SP4	2.0.16-150400.9.6.1 fixed
suse enterprise sap 15 SP5	2.0.16-150400.9.6.1 fixed
suse enterprise sap 15 SP6	2.0.16-150400.9.6.1 fixed
suse enterprise sap 15 SP7	2.0.16-150400.9.6.1 fixed
suse enterprise server 15 SP4	2.0.16-150400.9.6.1 fixed
suse enterprise server 15 SP5	2.0.16-150400.9.6.1 fixed
suse enterprise server 15 SP6	2.0.16-150400.9.6.1 fixed
suse enterprise server 15 SP7	2.0.16-150400.9.6.1 fixed

tomcat

suse enterprise sap 12 SP5	9.0.123-3.182.2 fixed
suse enterprise sap 15 SP4	9.0.122-150200.123.2 fixed
suse enterprise sap 15 SP5	9.0.122-150200.123.2 fixed
suse enterprise sap 15 SP6	9.0.122-150200.123.2 fixed
suse enterprise sap 15 SP7	9.0.122-150200.123.2 fixed
suse enterprise server 12 SP5	9.0.123-3.182.2 fixed
suse enterprise server 15 SP4	9.0.122-150200.123.2 fixed
suse enterprise server 15 SP5	9.0.122-150200.123.2 fixed
suse enterprise server 15 SP6	9.0.122-150200.123.2 fixed
suse enterprise server 15 SP7	9.0.122-150200.123.2 fixed

tomcat-admin-webapps

suse enterprise sap 12 SP5	9.0.123-3.182.2 fixed
suse enterprise sap 15 SP4	9.0.122-150200.123.2 fixed
suse enterprise sap 15 SP5	9.0.122-150200.123.2 fixed
suse enterprise sap 15 SP6	9.0.122-150200.123.2 fixed
suse enterprise sap 15 SP7	9.0.122-150200.123.2 fixed
suse enterprise server 12 SP5	9.0.123-3.182.2 fixed
suse enterprise server 15 SP4	9.0.122-150200.123.2 fixed
suse enterprise server 15 SP5	9.0.122-150200.123.2 fixed
suse enterprise server 15 SP6	9.0.122-150200.123.2 fixed
suse enterprise server 15 SP7	9.0.122-150200.123.2 fixed

tomcat-docs-webapp

suse enterprise sap 12 SP5	9.0.123-3.182.2 fixed
suse enterprise server 12 SP5	9.0.123-3.182.2 fixed

tomcat-el-3_0-api

suse enterprise sap 12 SP5	9.0.123-3.182.2 fixed
suse enterprise sap 15 SP4	9.0.122-150200.123.2 fixed
suse enterprise sap 15 SP5	9.0.122-150200.123.2 fixed
suse enterprise sap 15 SP6	9.0.122-150200.123.2 fixed
suse enterprise sap 15 SP7	9.0.122-150200.123.2 fixed
suse enterprise server 12 SP5	9.0.123-3.182.2 fixed
suse enterprise server 15 SP4	9.0.122-150200.123.2 fixed
suse enterprise server 15 SP5	9.0.122-150200.123.2 fixed
suse enterprise server 15 SP6	9.0.122-150200.123.2 fixed
suse enterprise server 15 SP7	9.0.122-150200.123.2 fixed

tomcat-javadoc

suse enterprise sap 12 SP5	9.0.123-3.182.2 fixed
suse enterprise server 12 SP5	9.0.123-3.182.2 fixed

tomcat-jsp-2_3-api

suse enterprise sap 12 SP5	9.0.123-3.182.2 fixed
suse enterprise sap 15 SP4	9.0.122-150200.123.2 fixed
suse enterprise sap 15 SP5	9.0.122-150200.123.2 fixed
suse enterprise sap 15 SP6	9.0.122-150200.123.2 fixed
suse enterprise sap 15 SP7	9.0.122-150200.123.2 fixed
suse enterprise server 12 SP5	9.0.123-3.182.2 fixed
suse enterprise server 15 SP4	9.0.122-150200.123.2 fixed
suse enterprise server 15 SP5	9.0.122-150200.123.2 fixed
suse enterprise server 15 SP6	9.0.122-150200.123.2 fixed
suse enterprise server 15 SP7	9.0.122-150200.123.2 fixed

tomcat-lib

suse enterprise sap 12 SP5	9.0.123-3.182.2 fixed
suse enterprise sap 15 SP4	9.0.122-150200.123.2 fixed
suse enterprise sap 15 SP5	9.0.122-150200.123.2 fixed
suse enterprise sap 15 SP6	9.0.122-150200.123.2 fixed
suse enterprise sap 15 SP7	9.0.122-150200.123.2 fixed
suse enterprise server 12 SP5	9.0.123-3.182.2 fixed
suse enterprise server 15 SP4	9.0.122-150200.123.2 fixed
suse enterprise server 15 SP5	9.0.122-150200.123.2 fixed
suse enterprise server 15 SP6	9.0.122-150200.123.2 fixed
suse enterprise server 15 SP7	9.0.122-150200.123.2 fixed

tomcat-servlet-4_0-api

suse enterprise sap 12 SP5	9.0.123-3.182.2 fixed
suse enterprise sap 15 SP4	9.0.122-150200.123.2 fixed
suse enterprise sap 15 SP5	9.0.122-150200.123.2 fixed
suse enterprise sap 15 SP6	9.0.122-150200.123.2 fixed
suse enterprise sap 15 SP7	9.0.122-150200.123.2 fixed
suse enterprise server 12 SP5	9.0.123-3.182.2 fixed
suse enterprise server 15 SP4	9.0.122-150200.123.2 fixed
suse enterprise server 15 SP5	9.0.122-150200.123.2 fixed
suse enterprise server 15 SP6	9.0.122-150200.123.2 fixed
suse enterprise server 15 SP7	9.0.122-150200.123.2 fixed

tomcat-webapps

suse enterprise sap 12 SP5	9.0.123-3.182.2 fixed
suse enterprise sap 15 SP4	9.0.122-150200.123.2 fixed
suse enterprise sap 15 SP5	9.0.122-150200.123.2 fixed
suse enterprise sap 15 SP6	9.0.122-150200.123.2 fixed
suse enterprise sap 15 SP7	9.0.122-150200.123.2 fixed
suse enterprise server 12 SP5	9.0.123-3.182.2 fixed
suse enterprise server 15 SP4	9.0.122-150200.123.2 fixed
suse enterprise server 15 SP5	9.0.122-150200.123.2 fixed
suse enterprise server 15 SP6	9.0.122-150200.123.2 fixed
suse enterprise server 15 SP7	9.0.122-150200.123.2 fixed

tomcat10

suse enterprise sap 15 SP5	10.1.60-150200.5.82.2 fixed
suse enterprise sap 15 SP6	10.1.60-150200.5.82.2 fixed
suse enterprise sap 15 SP7	10.1.60-150200.5.82.2 fixed
suse enterprise server 15 SP5	10.1.60-150200.5.82.2 fixed
suse enterprise server 15 SP6	10.1.60-150200.5.82.2 fixed
suse enterprise server 15 SP7	10.1.60-150200.5.82.2 fixed

tomcat10-admin-webapps

suse enterprise sap 15 SP5	10.1.60-150200.5.82.2 fixed
suse enterprise sap 15 SP6	10.1.60-150200.5.82.2 fixed
suse enterprise sap 15 SP7	10.1.60-150200.5.82.2 fixed
suse enterprise server 15 SP5	10.1.60-150200.5.82.2 fixed
suse enterprise server 15 SP6	10.1.60-150200.5.82.2 fixed
suse enterprise server 15 SP7	10.1.60-150200.5.82.2 fixed

tomcat10-el-5_0-api

suse enterprise sap 15 SP5	10.1.60-150200.5.82.2 fixed
suse enterprise sap 15 SP6	10.1.60-150200.5.82.2 fixed
suse enterprise sap 15 SP7	10.1.60-150200.5.82.2 fixed
suse enterprise server 15 SP5	10.1.60-150200.5.82.2 fixed
suse enterprise server 15 SP6	10.1.60-150200.5.82.2 fixed
suse enterprise server 15 SP7	10.1.60-150200.5.82.2 fixed

tomcat10-jsp-3_1-api

suse enterprise sap 15 SP5	10.1.60-150200.5.82.2 fixed
suse enterprise sap 15 SP6	10.1.60-150200.5.82.2 fixed
suse enterprise sap 15 SP7	10.1.60-150200.5.82.2 fixed
suse enterprise server 15 SP5	10.1.60-150200.5.82.2 fixed
suse enterprise server 15 SP6	10.1.60-150200.5.82.2 fixed
suse enterprise server 15 SP7	10.1.60-150200.5.82.2 fixed

tomcat10-lib

suse enterprise sap 15 SP5	10.1.60-150200.5.82.2 fixed
suse enterprise sap 15 SP6	10.1.60-150200.5.82.2 fixed
suse enterprise sap 15 SP7	10.1.60-150200.5.82.2 fixed
suse enterprise server 15 SP5	10.1.60-150200.5.82.2 fixed
suse enterprise server 15 SP6	10.1.60-150200.5.82.2 fixed
suse enterprise server 15 SP7	10.1.60-150200.5.82.2 fixed

tomcat10-servlet-6_0-api

suse enterprise sap 15 SP5	10.1.60-150200.5.82.2 fixed
suse enterprise sap 15 SP6	10.1.60-150200.5.82.2 fixed
suse enterprise sap 15 SP7	10.1.60-150200.5.82.2 fixed
suse enterprise server 15 SP5	10.1.60-150200.5.82.2 fixed
suse enterprise server 15 SP6	10.1.60-150200.5.82.2 fixed
suse enterprise server 15 SP7	10.1.60-150200.5.82.2 fixed

tomcat10-webapps

suse enterprise sap 15 SP5	10.1.60-150200.5.82.2 fixed
suse enterprise sap 15 SP6	10.1.60-150200.5.82.2 fixed
suse enterprise sap 15 SP7	10.1.60-150200.5.82.2 fixed
suse enterprise server 15 SP5	10.1.60-150200.5.82.2 fixed
suse enterprise server 15 SP6	10.1.60-150200.5.82.2 fixed
suse enterprise server 15 SP7	10.1.60-150200.5.82.2 fixed

tomcat11

suse enterprise sap 15 SP6	11.0.26-150600.13.36.2 fixed
suse enterprise sap 15 SP7	11.0.26-150600.13.36.2 fixed
suse enterprise server 15 SP6	11.0.26-150600.13.36.2 fixed
suse enterprise server 15 SP7	11.0.26-150600.13.36.2 fixed

tomcat11-admin-webapps

suse enterprise sap 15 SP6	11.0.26-150600.13.36.2 fixed
suse enterprise sap 15 SP7	11.0.26-150600.13.36.2 fixed
suse enterprise server 15 SP6	11.0.26-150600.13.36.2 fixed
suse enterprise server 15 SP7	11.0.26-150600.13.36.2 fixed

tomcat11-el-6_0-api

suse enterprise sap 15 SP6	11.0.26-150600.13.36.2 fixed
suse enterprise sap 15 SP7	11.0.26-150600.13.36.2 fixed
suse enterprise server 15 SP6	11.0.26-150600.13.36.2 fixed
suse enterprise server 15 SP7	11.0.26-150600.13.36.2 fixed

tomcat11-jsp-4_0-api

suse enterprise sap 15 SP6	11.0.26-150600.13.36.2 fixed
suse enterprise sap 15 SP7	11.0.26-150600.13.36.2 fixed
suse enterprise server 15 SP6	11.0.26-150600.13.36.2 fixed
suse enterprise server 15 SP7	11.0.26-150600.13.36.2 fixed

tomcat11-lib

suse enterprise sap 15 SP6	11.0.26-150600.13.36.2 fixed
suse enterprise sap 15 SP7	11.0.26-150600.13.36.2 fixed
suse enterprise server 15 SP6	11.0.26-150600.13.36.2 fixed
suse enterprise server 15 SP7	11.0.26-150600.13.36.2 fixed

tomcat11-servlet-6_1-api

suse enterprise sap 15 SP6	11.0.26-150600.13.36.2 fixed
suse enterprise sap 15 SP7	11.0.26-150600.13.36.2 fixed
suse enterprise server 15 SP6	11.0.26-150600.13.36.2 fixed
suse enterprise server 15 SP7	11.0.26-150600.13.36.2 fixed

tomcat11-webapps

suse enterprise sap 15 SP6	11.0.26-150600.13.36.2 fixed
suse enterprise sap 15 SP7	11.0.26-150600.13.36.2 fixed
suse enterprise server 15 SP6	11.0.26-150600.13.36.2 fixed
suse enterprise server 15 SP7	11.0.26-150600.13.36.2 fixed