CVE-2026-86247

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-86247", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-09-06T10:13:13.570Z", "datePublished": "2026-09-23T12:31:53.210Z", "dateUpdated": "2026-09-23T18:10:50.704Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-09-23T12:31:53.210Z"}, "title": "Apache Tomcat Native: Client certificate requirements can be down-graded", "problemTypes": [{"descriptions": [{"description": "CWE-366 Race condition within a thread", "lang": "en", "cweId": "CWE-366", "type": "CWE"}]}], "source": {"discovery": "INTERNAL"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Tomcat Native", "versions": [{"status": "affected", "version": "2.0.0", "lessThanOrEqual": "2.0.15", "versionType": "semver"}, {"status": "affected", "version": "1.3.0", "lessThanOrEqual": "1.3.8", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"value": "Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations.\n\n\n\nThis issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 2.0.16 or 1.3.9, which fixes the issue.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations.</p><p>This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be affected.</p><p>Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fixes the issue.</p>"}]}], "references": [{"url": "https://lists.apache.org/thread/obsson6zhvfg0wsp2bx602l61ltj87r1", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "x_generator": {"engine": "Vulnogram 1.0.3"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-09-23T15:30:32.467469Z", "id": "CVE-2026-86247", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-23T15:30:52.270Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/09/23/33"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-09-23T18:10:50.704Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/09/23/33"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-09-23T18:10:50.704Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-86247", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-23T15:30:32.467469Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-23T15:30:49.112Z"}}], "cna": {"title": "Apache Tomcat Native: Client certificate requirements can be down-graded", "source": {"discovery": "INTERNAL"}, "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Tomcat Native", "versions": [{"status": "affected", "version": "2.0.0", "versionType": "semver", "lessThanOrEqual": "2.0.15"}, {"status": "affected", "version": "1.3.0", "versionType": "semver", "lessThanOrEqual": "1.3.8"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread/obsson6zhvfg0wsp2bx602l61ltj87r1", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.3"}, "descriptions": [{"lang": "en", "value": "Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations.\n\n\n\nThis issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 2.0.16 or 1.3.9, which fixes the issue.", "supportingMedia": [{"type": "text/html", "value": "<p>Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations.</p><p>This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be affected.</p><p>Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fixes the issue.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-366", "description": "CWE-366 Race condition within a thread"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-09-23T12:31:53.210Z"}}}, "cveMetadata": {"cveId": "CVE-2026-86247", "state": "PUBLISHED", "dateUpdated": "2026-09-23T18:10:50.704Z", "dateReserved": "2026-09-06T10:13:13.570Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-09-23T12:31:53.210Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Apache Tomcat Native", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "2.0.15", "status": "affected", "version": "2.0.0", "versionType": "semver"}, {"lessThanOrEqual": "1.3.8", "status": "affected", "version": "1.3.0", "versionType": "semver"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:tomcat_native:*:*:*:*:*:*:*:*", "matchCriteriaId": "F73CA9D6-BD48-4223-B2AC-6F345E0895C6", "versionEndExcluding": "1.3.9", "versionStartIncluding": "1.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:tomcat_native:*:*:*:*:*:*:*:*", "matchCriteriaId": "AC3D1E2E-A1EE-4F33-8D7F-11D37A8AAE66", "versionEndExcluding": "2.0.16", "versionStartIncluding": "2.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations.\n\n\n\nThis issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 2.0.16 or 1.3.9, which fixes the issue."}], "id": "CVE-2026-86247", "lastModified": "2026-10-06T13:46:49.633", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-86247", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-09-23T15:30:32.467469Z", "version": "2.0.3"}}]}, "published": "2026-09-23T13:17:31.237", "references": [{"source": "security@apache.org", "tags": ["Vendor Advisory"], "url": "https://lists.apache.org/thread/obsson6zhvfg0wsp2bx602l61ltj87r1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/09/23/33"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-366"}], "source": "security@apache.org", "type": "Secondary"}]}

{"bugzilla": {"description": "tomcat-native: Apache Tomcat Native: Client certificate verification requirements can be down-graded via race condition", "id": "2539393", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2539393"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-366", "details": ["Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations.\nThis issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be affected.\nUsers are recommended to upgrade to version 2.0.16 or 1.3.9, which fixes the issue.", "A flaw was found in Apache Tomcat Native. A race condition within a thread allows client certificate verification requirements to be down-graded for certain configurations. This could enable an attacker to bypass stricter authentication requirements, potentially leading to unauthorized access or reduced security posture."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-86247", "package_state": [{"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:5", "fix_state": "Affected", "package_name": "jws5-tomcat-native", "product_name": "Red Hat JBoss Web Server 5"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:6", "fix_state": "Affected", "package_name": "jws6-tomcat-native", "product_name": "Red Hat JBoss Web Server 6"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_web_server:7", "fix_state": "Affected", "package_name": "jws7-tomcat-native", "product_name": "Red Hat JBoss Web Server 7"}], "public_date": "2026-09-23T12:31:53Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-86247\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-86247\nhttps://lists.apache.org/thread/obsson6zhvfg0wsp2bx602l61ltj87r1"], "statement": "This flaw is rated as Moderate severity because successful exploitation requires winning a precise race condition during concurrent TLS handshakes, limiting the predictability of an attack. Impact is restricted to environments where Apache Tomcat Native is explicitly configured to perform mutual TLS and validate client certificates, which is not an active configuration by default in Red Hat JBoss Web Server. An attacker must precisely time multi-threaded connection requests to cause an authentication requirement downgrade.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.0,2.0.15]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.3.0,1.3.8]"}}], "enrichment": {"confidence": 85.0, "confidence_source": "matching", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 85.0, "source": "matching"}]}, "original": {"product": "Apache Tomcat Native", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "apache_tomcat", "vendor": "apache"}], "created": "2026-09-23T14:15:06.441256+00:00", "updated": "2026-09-23T18:00:07.950069+00:00", "vendors": ["apache", "apache$PRODUCT$apache_tomcat"]}