CVE-2026-86247

Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be affected. Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fixes the issue.

Score

CVSS 3.1 7.4 High

Status

Analyzed - security@apache.org

Published

2026-09-23

Last modified

2026-10-06

Weaknesses

CWE-366

Affected products

• Tomcat Native (Apache)
• Apache Tomcat Native (Apache Software Foundation)

References

• https://lists.apache.org/thread/obsson6zhvfg0wsp2bx602l61ltj87r1
• http://www.openwall.com/lists/oss-security/2026/09/23/33