Vulnerability · Published Sep 23, 2026 · Assigned by apache
CVE-2026-86247Apache Tomcat Native: Client certificate requirements can be down-graded
High 7.4
In plain English
A high-severity security flaw in Apache Tomcat Native from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be affected. Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fixes the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.24 | tomcat-native | 2.0.16-r0 | ALPINE-CVE-2026-86247 |
| Debian:12 | tomcat-native | no fix listed | DEBIAN-CVE-2026-86247 |
| Debian:13 | tomcat-native | no fix listed | DEBIAN-CVE-2026-86247 |
| Debian:14 | tomcat-native | 2.0.16-1 | DEBIAN-CVE-2026-86247 |
| Ubuntu:22.04:LTS | tomcat-native | no fix listed | UBUNTU-CVE-2026-86247 |
| Ubuntu:24.04:LTS | tomcat-native | no fix listed | UBUNTU-CVE-2026-86247 |
| Ubuntu:26.04:LTS | tomcat-native | no fix listed | UBUNTU-CVE-2026-86247 |
| Ubuntu:26.10 | tomcat-native | no fix listed | UBUNTU-CVE-2026-86247 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Tomcat Native | 2.0.0 – through 2.0.151.3.0 – through 1.3.8 |
Weakness: CWE-366 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N