CVE-2026-86243: apache software foundation apache tomcat native Buffer Over-read
Vulnerability summary
CVE-2026-86243 is a high (CVSS 7.5) Buffer Over-read vulnerability in apache software foundation apache tomcat native. EPSS estimates a 0.60% chance of exploitation in the next 30 days, higher than 47.8% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 8 · Related 7Timeline
- 23-09-2026PublishedVulnerability first disclosed.
- 23-09-2026Last modifiedVulnerability information updated.
Description
Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versions may also be affected. Users are recommended to upgrade to version 1.3.9 or 2.0.16, which fix the issue.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.60%
Chance of exploitation in the next 30 days
Percentile
48%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Apache1 product
- tomcat_native≥ 1.3.0, < 1.3.9 | ≥ 2.0.0, < 2.0.16
Apache software foundation1 product
- apache tomcat native≥ 2.0.0, ≤ 2.0.15 | ≥ 1.3.0, ≤ 1.3.8
Debian1 product
- tomcat-nativeAll versions (No fix recorded) | < 2.0.16-1
Ubuntu1 product
- tomcat-nativeAll versions (No fix recorded)
4 vendors · 4 products
