CVE-2026-86246

CriticalCVSS 9.1/10Last modified Oct 6, 2026

Description

Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX.

This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier unsupported versions may also be affected.

Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fix the issue.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-1188

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Tomcat Native	>= 2.0.0, <= 2.0.15; >= 1.3.0, <= 1.3.8

References

https://lists.apache.org/thread/dgyvfwb24nbk45ptvlhdyhdhl5o7k5olVendor Advisory, Mailing List
http://www.openwall.com/lists/oss-security/2026/09/23/32Mailing List, Third Party Advisory

Timeline

Published: Sep 23, 2026
Last modified: Oct 6, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-862477.4Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded CVE-2026-862489.8CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat. This i CVE-2026-862499.1On a brpc::Server that sets both ServerOptions.auth and ServerOptions.internal_port, the HTTP built-in service exemption on internal_port ca CVE-2026-86256.4The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t CVE-2026-862507.5h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie() and deleteCh CVE-2026-862515.9h3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility. A double-decoding flaw allows a request path co CVE-2026-862525.3h3 versions before 1.15.9 fail to sanitize carriage return characters in EventStream data and comment fields, allowing attackers to inject a CVE-2026-862535.9h3 (npm package) versions <= 2.0.1-rc.14 contain a path traversal vulnerability in serveStatic(). On Node.js deployments, event.url.pathname CVE-2026-862546.8wger versions through master contain an incomplete authorization bypass in wger/core/views/user.py where three views retain the original gym CVE-2026-862556.5wger before 2.5 fails to validate the maximum duration of routine date ranges, allowing authenticated users to create routines spanning arbi CVE-2026-862565.4wger before 2.6 (affected versions <= 2.5.0) contains an open redirect vulnerability in the trainer_login view (wger/core/views/user.py). Af CVE-2026-862575.4wger before 2.6 fails to sanitize first_name and last_name fields in the gym member TSV export endpoint, allowing any gym member to inject s