CVE-2026-86243 in Tomcat Native
Summary
by MITRE • 09/23/2026
Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash.
This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versions may also be affected.
Users are recommended to upgrade to version 1.3.9 or 2.0.16, which fix the issue.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
The vulnerability identified in Apache Tomcat Native represents a critical security flaw within the library's implementation of TLS handshake procedures. Specifically, this is classified as a buffer over-read condition that occurs when processing incoming network data during the establishment of secure connections. The root cause lies in improper bounds checking or logic errors within the native code layer that interfaces with Java through JNI (Java Native Interface). When a client initiates a TLS connection, the server processes various handshake messages and certificates. If an attacker crafts specific malformed packets or sends unexpected data sequences, they can exploit this flaw to read memory beyond the allocated buffer boundaries. This type of error is commonly associated with CWE-126, which covers Buffer Over-read vulnerabilities where software reads past the end of a buffer due to insufficient validation of input lengths or indices.
The operational impact of this vulnerability is primarily focused on service availability rather than data confidentiality or integrity in most immediate scenarios. Because the over-read occurs within the native library handling TLS connections, it often leads to an access violation or segmentation fault within the Java Virtual Machine (JVM). This results in a crash of the Tomcat process hosting the affected application. For organizations relying on Apache Tomcat for web services, this translates directly into a Denial of Service condition. An unauthenticated attacker can exploit this by sending specially crafted TLS handshake packets to any open port running the vulnerable version of Tomcat Native. The resulting JVM crashes cause immediate downtime for the hosted applications, disrupting business operations and potentially causing data loss if transactions are in progress at the time of the crash. This aligns with ATT&CK technique T1499, Endpoint Denial of Service, where an adversary disrupts access to or availability of computed resources by consuming them or exploiting a vulnerability that causes instability.
The scope of this issue is significant as it affects multiple major versions of Apache Tomcat Native, specifically ranging from version 2.0.0 through 2.0.15 and from 1.3.0 through 1.3.8. It is also noted that earlier unsupported versions may be susceptible to similar issues due to the lack of ongoing security patches in those legacy branches. This wide range of affected versions indicates a systemic issue within the codebase rather than an isolated incident, highlighting the importance of maintaining up-to-date dependencies in enterprise environments. The vulnerability underscores the risks associated with using native libraries that bridge C/C++ code with Java applications, as memory management errors in these layers can have severe consequences for the stability of the entire runtime environment.
To mitigate this risk, organizations must prioritize upgrading Apache Tomcat Native to version 1.3.9 or 2.0.16, which contain the necessary fixes for the buffer over-read condition. It is crucial to verify that all instances of Tomcat across development, staging, and production environments are updated consistently. In addition to patching, administrators should implement network-level controls such as rate limiting on TLS handshake requests to mitigate potential abuse while patches are being deployed. Monitoring logs for JVM crashes or segmentation faults can also help in detecting exploitation attempts early. Furthermore, organizations should conduct a thorough inventory of their Tomcat deployments to ensure no legacy versions remain in use, particularly those that have reached end-of-life status and lack official support from the Apache Software Foundation. Regular security assessments and penetration testing focused on TLS implementations can further strengthen defenses against such protocol-level vulnerabilities.