Product · Apache Software Foundation

Apache Tomcat Native

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

Critical 9.1

CVE-2026-86246

Apache Tomcat Native: Insecure OpenSSL options enabled

Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX. This issue affects Apa…

Apache Software Foundation Apache Tomcat Native tomcat-native tomcat-native Debian Ubuntu Alpine

Sep 23, 2026
Critical 9.1

CVE-2026-29145 Public exploit

Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0…

Apache Software Foundation Apache Tomcat Apache Tomcat Native org.apache.tomcat:tomcat Debian Ubuntu Alpine Maven

Apr 9, 2026