CVE-2026-86247: Apache Tomcat Native Race Condition Vulnerability

CVE-2026-86247 Overview

CVE-2026-86247 is a race condition vulnerability in Apache Tomcat Native that allows client certificate verification requirements to be downgraded in certain configurations. The flaw affects Apache Tomcat Native versions 2.0.0 through 2.0.15 and 1.3.0 through 1.3.8. Unsupported versions may also be impacted. Attackers exploiting this race condition can bypass mutual TLS authentication controls that gate access to protected resources. The Apache Tomcat project fixed the issue in versions 2.0.16 and 1.3.9. The vulnerability is classified under [CWE-366] Race Condition within a Thread.

Critical Impact
Exploitation permits network attackers to bypass client certificate verification, undermining mutual TLS trust boundaries and exposing protected endpoints to unauthenticated access.

Affected Products

Apache Tomcat Native 2.0.0 through 2.0.15
Apache Tomcat Native 1.3.0 through 1.3.8
Unsupported Apache Tomcat Native releases prior to 1.3.0

Discovery Timeline

2026-09-23 - CVE-2026-86247 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-86247

Vulnerability Analysis

Apache Tomcat Native provides Java Native Interface (JNI) bindings to OpenSSL for TLS termination inside Apache Tomcat. The library enforces client certificate verification settings during the TLS handshake. Under specific configurations, a race condition within a single thread allows the verification requirement to be downgraded between the time the setting is applied and the time it is enforced. When the downgrade occurs, the server accepts TLS sessions without validating the client certificate as configured. Applications that depend on mutual TLS for authorization then process requests from clients that should have been rejected.

The issue carries integrity and confidentiality impact because bypassed authentication exposes protected resources. Exploitation requires network access to the TLS endpoint and precise timing, which raises attack complexity but does not require prior privileges or user interaction.

Root Cause

The root cause is a race condition within a thread [CWE-366] in the certificate verification code path. Concurrent operations on shared verification state permit a window where the enforced requirement differs from the configured requirement. The fix in Apache Tomcat Native 2.0.16 and 1.3.9 closes this window and ensures the verification mode applied during the handshake reflects the configured policy.

Attack Vector

The vulnerability is exploited over the network against a Tomcat server that terminates TLS through the Tomcat Native connector and requires client certificates. An attacker connects to the TLS endpoint and triggers the race window during the handshake. When successful, the server completes the handshake without enforcing certificate validation. The attacker then issues requests to protected resources that would normally require a valid client certificate. See the Apache Mailing List Thread and the Openwall OSS-Security Update for the vendor advisory details.

No public proof-of-concept exploit code is available for this vulnerability. Refer to the vendor advisory for technical specifics.

Detection Methods for CVE-2026-86247

Indicators of Compromise

TLS sessions established with connectors configured for clientAuth="true" where no client certificate is present in access logs.
Successful HTTP requests to protected paths from source addresses lacking prior mutual TLS enrollment.
Anomalous handshake patterns showing repeated, rapid connection attempts against TLS endpoints requiring client certificates.

Detection Strategies

Review Tomcat access logs and correlate SSL_CLIENT_S_DN or equivalent variables against expected client identities for connectors requiring mutual TLS.
Enable verbose TLS logging on the Tomcat Native connector and alert on handshakes that complete without a presented client certificate on clientAuth connectors.
Compare deployed Apache Tomcat Native versions against fixed versions 2.0.16 and 1.3.9 using software inventory data.

Monitoring Recommendations

Instrument perimeter and internal load balancers to record client certificate presentation and rejection counts per connector.
Alert on spikes in TLS handshake attempts against endpoints that require client certificates.
Track authentication decisions in downstream application logs and flag requests reaching protected resources without a corresponding verified certificate identity.

How to Mitigate CVE-2026-86247

Immediate Actions Required

Upgrade Apache Tomcat Native to version 2.0.16 (2.0.x branch) or 1.3.9 (1.3.x branch) on all affected servers.
Inventory all Tomcat deployments using the native connector (APR/Native) and confirm library versions with catalina.sh version.
Audit TLS connectors configured with clientAuth="true" or certificateVerification="required" for anomalous access during the exposure window.

Patch Information

Apache released fixed builds of Tomcat Native in versions 2.0.16 and 1.3.9. Details of the fix and affected versions are documented in the Apache Mailing List Thread and the Openwall OSS-Security Update. Users on unsupported branches should migrate to a supported release before applying the patch.

Workarounds

Switch the affected connector from the APR/Native implementation to the JSSE-based NIO or NIO2 implementation until patching is complete.
Enforce client certificate verification at an upstream reverse proxy or load balancer that is not affected by this issue.
Restrict network access to the affected TLS endpoints to trusted client networks using firewall rules while remediation is in progress.

bash

# Verify Apache Tomcat Native version in use
$CATALINA_HOME/bin/catalina.sh version | grep -i "APR\|Native"

# Example server.xml connector using JSSE NIO as an interim workaround
# <Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
#            SSLEnabled="true" clientAuth="true" sslProtocol="TLS" />