CVE-2026-86247: Apache Tomcat Native: Client certificate requirements can be down-graded
Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations.
This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be affected.
Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Tomcat Nativeto a version that resolves this vulnerability.Fixed in 2.0.16 - Upgrade
Upgrade
Apache Tomcat Nativeto a version that resolves this vulnerability.Fixed in 1.3.9
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Apache Tomcat Native deployments using versions 2.0.0 through 2.0.15 or 1.3.0 through 1.3.8 are affected. Unsupported versions may also be affected, and the issue applies to some configurations involving client certificate verification requirements.
What is the security impact of successful exploitation?
A race condition within a thread can cause client certificate verification requirements to be downgraded. This can weaken the intended client-certificate authentication enforcement for affected configurations.
What versions remediate the issue?
Upgrade Apache Tomcat Native to version 2.0.16 or 1.3.9. These versions fix the vulnerability.