CVE-2026-86246
Description
A flaw was found in Apache Tomcat Native, which enabled several insecure OpenSSL options by default: ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF, and ALLOW_NO_DHE_KEX. These defaults can weaken TLS protections. Apache Tomcat Native versions 1.3.0 through 1.3.8 and 2.0.0 through 2.0.15 are affected; the issue is fixed in versions 1.3.9 and 2.0.16.
Statement
Red Hat rates this flaw Moderate. Apache also rates it Moderate. The issue is caused by insecure OpenSSL options being enabled by default in Apache Tomcat Native.
Red Hat's CVSS 3.1 score is 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). The CVE record also includes a CISA ADP score of 9.1 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). The assessments differ in their evaluation of attack complexity and confidentiality and integrity impact.
Mitigation
Upgrade Apache Tomcat Native to version 1.3.9 or 2.0.16, as applicable. For JBoss Web Server, apply the corresponding Red Hat security update when available. Apache’s advisory does not list an alternative workaround.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.3 | N/A | 9.1 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
