Apache Tomcat Native (Apache Software Foundation) - vulnerabilities (CVEs)

8 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2026-09-23. Vendor: Apache Software Foundation.

CVEs of Apache Tomcat Native

• CVE-2026-86247 - CVSS 7.4 (high), 2026-09-23: Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some…
• CVE-2026-86246 - CVSS 9.1 (critical), 2026-09-23: Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including…
• CVE-2026-86243 - CVSS 7.5 (high), 2026-09-23: Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects…
• CVE-2026-29145 - CVSS 9.1 (critical), 2026-04-09: CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native. This…
• CVE-2026-24734 - CVSS 7.5 (high), 2026-02-17: Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the…
• CVE-2018-8020 - CVSS 7.4 (high), 2018-07-31: Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 has a flaw that does not properly check OCSP pre-produced responses, which are lists (multiple…
• CVE-2018-8019 - CVSS 7.4 (high), 2018-07-31: When using an OCSP responder Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 did not correctly handle invalid responses. This allowed for revoked…
• CVE-2017-15698 - CVSS 5.9 (medium), 2018-01-31: When parsing the AIA-Extension field of a client certificate, Apache Tomcat Native Connector 1.2.0 to 1.2.14 and 1.1.23 to 1.1.34 did not correctly handle…