Veille CVE

Recherche « Apache Software Foundation Apache Tomcat Native »

4 CVE

Critique 1 Élevée 2 Moyenne 0 Faible 0 Non évaluée 1 Exploitées (KEV) Tri : plus récentes « Apache Software Foundation Apache Tomcat Native » ✕
  1. CVE-2026-80353 – Non évaluée

    Apache Software Foundation Apache Tomcat

    Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector allows an unauthorised local user to access the unix domain socket. The fix for CVE-2026-65183 only addressed the NIO connector. It did not address the same issue in the APR/Native connector. This issue affects Apache Tomcat: from 9.0.47 through 9.0.122. Users are recommended to upgrade to version 9.0.123, which fixes the issue.

  2. CVE-2026-86247 7.4 Élevée

    Apache Software Foundation Apache Tomcat Native · Apache tomcat native

    Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be affected. Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fixes the issue.

  3. CVE-2026-86246 9.1 Critique

    Apache Software Foundation Apache Tomcat Native · Apache tomcat native

    Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier unsupported versions may also be affected. Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fix the issue.

  4. CVE-2026-86243 7.5 Élevée

    Apache Software Foundation Apache Tomcat Native · Apache tomcat native

    Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versions may also be affected. Users are recommended to upgrade to version 1.3.9 or 2.0.16, which fix the issue.