Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-86247: Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be affected. Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fixes the issue.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | tomcat-native | 0:1.2.38-2.amzn2 |
| Amazon Linux · 2 | tomcat-native-debuginfo | 0:1.2.38-2.amzn2 |
Vulnerabilities 1
-
High 7.4
Apache Tomcat Native: Client certificate requirements can be down-graded
Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. …
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-86247.html