CVE-2026-86243: Apache Tomcat Native DoS Vulnerability

CVE-2026-86243 Overview

CVE-2026-86243 is a buffer over-read vulnerability in Apache Tomcat Native that occurs during the Transport Layer Security (TLS) handshake. A remote unauthenticated attacker can trigger a denial of service (DoS) by crashing the Java Virtual Machine (JVM) hosting Tomcat. The flaw affects Apache Tomcat Native versions 2.0.0 through 2.0.15 and 1.3.0 through 1.3.8. Earlier, unsupported releases may also be affected. The Apache Software Foundation has released fixed versions 1.3.9 and 2.0.16. The weakness maps to [CWE-126: Buffer Over-read].

Critical Impact
An unauthenticated network attacker can crash the JVM through a malformed TLS handshake, taking Tomcat services offline without requiring credentials or user interaction.

Affected Products

Apache Tomcat Native 2.0.0 through 2.0.15
Apache Tomcat Native 1.3.0 through 1.3.8
Earlier, unsupported Apache Tomcat Native versions

Discovery Timeline

2026-09-23 - CVE-2026-86243 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-86243

Vulnerability Analysis

Apache Tomcat Native provides Java Native Interface (JNI) bindings that let Tomcat use OpenSSL for TLS termination instead of the standard Java Secure Socket Extension (JSSE) implementation. The vulnerability resides in the native TLS handshake code path. When a crafted handshake message is processed, the native library reads past the end of an allocated buffer.

Because the over-read occurs in native code executed by the JVM, the resulting invalid memory access crashes the entire Java process. Any application running in the same JVM is terminated. The impact is limited to availability; the advisory does not describe confidentiality or integrity compromise.

Root Cause

The defect is a classic buffer over-read [CWE-126] in the TLS handshake parsing logic within the Tomcat Native library. The code does not correctly validate a length or offset before reading from a buffer, causing it to access memory beyond the intended bounds during handshake processing.

Attack Vector

Exploitation is remote and requires no authentication or user interaction. An attacker sends a malformed TLS handshake to any network endpoint served by a vulnerable Tomcat instance using Tomcat Native. Because TLS termination happens before request routing, exposed HTTPS listeners are reachable from any client that can complete a TCP connection. Repeated exploitation forces continuous JVM restarts and sustained service outage.

No public proof-of-concept exploit was referenced in the advisory. See the Apache Mailing List Discussion and the Openwall OSS Security Update for vendor-supplied technical detail.

Detection Methods for CVE-2026-86243

Indicators of Compromise

Unexpected JVM crash logs referencing native frames from libtcnative or OpenSSL routines during TLS handshake processing.
hs_err_pid*.log files generated by the JVM containing SIGSEGV signals originating in the Tomcat Native library.
Repeated Tomcat process restarts by the service manager (systemd, Windows Service Control Manager) shortly after inbound TLS connections.

Detection Strategies

Inventory Tomcat deployments and identify instances loading tcnative-1 versions below 1.3.9 or 2.0.16.
Correlate abrupt Tomcat termination events with inbound TLS traffic from a single source or a small set of sources.
Monitor TLS listeners for handshakes that terminate abnormally before the ChangeCipherSpec message.

Monitoring Recommendations

Alert on Java process exits with non-zero exit codes on hosts running Tomcat with the APR/native connector.
Ingest Tomcat catalina.out and JVM crash dumps into a centralized logging platform for pattern matching.
Track connection rate anomalies against HTTPS ports fronted by Tomcat Native.

How to Mitigate CVE-2026-86243

Immediate Actions Required

Upgrade Apache Tomcat Native to version 1.3.9 (1.3.x branch) or 2.0.16 (2.0.x branch).
Identify any Tomcat installation using the APR/native connector and confirm the loaded tcnative library version.
Restrict exposure of Tomcat TLS listeners to trusted networks where feasible until patching is complete.

Patch Information

The Apache Software Foundation fixed the buffer over-read in Apache Tomcat Native 1.3.9 and 2.0.16. Administrators should replace the native library binaries on all Tomcat hosts and restart the affected JVM processes. Refer to the Apache Mailing List Discussion for release details.

Workarounds

Switch the Tomcat HTTPS connector from the APR/native implementation to the JSSE implementation (NIO or NIO2) to bypass the vulnerable native TLS code path.
Terminate TLS at an upstream reverse proxy or load balancer that is not affected, forwarding plaintext HTTP to Tomcat on an internal network.
Rate-limit inbound TLS handshake attempts at the network edge to slow exploitation attempts until patches are deployed.

bash

# Example: configure Tomcat server.xml to use the JSSE NIO connector instead of APR
# Replace the vulnerable native connector with a Java-based TLS connector
<Connector port="8443"
           protocol="org.apache.coyote.http11.Http11NioProtocol"
           SSLEnabled="true"
           maxThreads="200"
           scheme="https"
           secure="true">
    <SSLHostConfig>
        <Certificate certificateKeystoreFile="conf/localhost-rsa.jks"
                     type="RSA" />
    </SSLHostConfig>
</Connector>