CVE-2026-86243 Apache Tomcat Native: DoS via TLS handshake
A buffer over-read in Apache Tomcat Native during TLS handshake allows attackers to cause a JVM crash and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-86243?
CVE-2026-86243 is a high-severity denial of service vulnerability in Apache Tomcat Native, published on 23 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash.
This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versions may also be affected.
Users are recommended to upgrade to version 1.3.9 or 2.0.16, which fix the issue.
Weakness: CWE-126
Which versions are affected by CVE-2026-86243?
It affects 1 product.
Products include Apache Tomcat Native.
How do I fix CVE-2026-86243?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-86243 being exploited?
There is no known exploitation of CVE-2026-86243 in the wild and no public exploit code.
Other vulnerabilities in Apache Tomcat Native
- CVE-2026-86246 Apache Tomcat Native: Insecure OpenSSL options enabled
- CVE-2026-86247 Apache Tomcat Native: Client certificate requirements can be down-graded
- CVE-2018-8019 Auth bypass in Apache Tomcat Native
- CVE-2018-8020 Auth bypass in Apache Tomcat Native
- CVE-2017-15698 Security feature bypass in Apache Tomcat Native
Sources
Also known as DEBIAN-CVE-2026-86243, GHSA-w68h-fc49-cmrg, MINI-24w8-4395-c3ch, UBUNTU-CVE-2026-86243.