CVE-2026-86247— Apache Tomcat Native: Client certificate requirements can be down-graded
Quick assessment
Affected
Apache Software Foundation Apache Tomcat Native
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. U
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-86247
Vulnerability Information
Shenlong is analyzing...
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Tomcat Native: Client certificate requirements can be down-graded
Source: CVE Program / CVE List V5
Vulnerability Description
Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations.
This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be affected.
Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
单线程内的竞争条件
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Tomcat Native | 2.0.0 ~ 2.0.15 | - |
|
II. Public POCs for CVE-2026-86247
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-86247
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-86247 (1)
Same Patch Batch · Apache Software Foundation · 2026-09-23 · 25 CVEs total
| CVE-2026-31377 | 7.5 HIGH | Apache Doris: Improper Authentication Allows Unauthorized Access to FE Meta Service |
| CVE-2026-75973 | Apache Tomcat: Cross-context authentication mix-up with Jakarta Authentication configured | |
| CVE-2026-82331 | Apache BuildStream: tar source extraction escape | |
| CVE-2026-73192 | Apache Sling XSS: XSS possible through XSSAPI.getValidHref() | |
| CVE-2026-92001 | Apache Sling XSS: Missing parser resource limits | |
| CVE-2026-91999 | Apache Sling XSS: Improper escaping in the XSS Webconsole plugin | |
| CVE-2026-91852 | Apache Sling XSS: CWE-79 multiple raw-string break-outs and ReDOS in XSSImpl | |
| CVE-2026-96443 | Apache Doris: JDBC driver URL validation bypass leads to remote code execution | |
| CVE-2026-91928 | Apache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf prote | |
| CVE-2026-94251 | Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape | |
| CVE-2026-94243 | Apache Sling Security Bundle: RefererFilter accepts weaker-than-origin evidence | |
| CVE-2026-73581 | Apache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate us | |
| CVE-2026-86246 | Apache Tomcat Native: Insecure OpenSSL options enabled | |
| CVE-2026-76183 | Apache Tomcat: Bypass of security constraints for WebSocket endpoints | |
| CVE-2026-77756 | Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests | |
| CVE-2026-77762 | Apache Tomcat: Stale HPACK emitter injects trailers into recycled pooled Request | |
| CVE-2026-77791 | Apache Tomcat: DoS via busy wait during WebSocket close | |
| CVE-2026-78383 | Apache Tomcat: AJP DoS via missing request body | |
| CVE-2026-78437 | Apache Tomcat: HTTP/2 DoS via malformed request | |
| CVE-2026-79677 | Apache Tomcat: WebSocket DoS due to lost asynchronous write timeout |
Showing top 20 of 25 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Apache Tomcat Native
Same vendor: Apache Software Foundation
-
CVE-2026-86246
Apache Tomcat Native: Insecure OpenSSL options enabled -
CVE-2026-86243
Apache Tomcat Native: DoS via TLS handshake -
CVE-2026-87022
Apache Tomcat: WebSocket message smuggling with per-message- -
CVE-2026-86350
Apache Tomcat: Regression in fix for CVE-2026-41293 can trig -
CVE-2026-86248
Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP c
Same weakness: CWE-366
-
CVE-2026-25687
ZCC race condition in ZPA tunnel handler -
CVE-2026-3904
GNU C Library 安全漏洞 -
CVE-2026-23684
Race condition vulnerability in SAP Commerce Cloud -
CVE-2026-22819
Outray has a Race Condition in main/apps/web/src/routes/api/ -
CVE-2025-31115
XZ has a heap-use-after-free bug in threaded .xz decoder
V. Comments for CVE-2026-86247
No comments yet