CVE-2026-86243
🟡 Monitoruj
Przepełnienie bufora w Apache Tomcat Native pozwala na wywołanie awarii JVM przez złośliwego użytkownika.
CVSS
7.5
EPSS
0.4%
Exploit
none
Vendor
apache
Opis źródłowy (NVD)
Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versions may also be affected. Users are recommended to upgrade to version 1.3.9 or 2.0.16, which fix the issue.
dos
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 7.5 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 0.4% |
| Opublikowano (NVD) | 2026-09-23 13:17:30 UTC |
| Ostatnia modyfikacja (NVD) | 2026-10-06 13:53:46 UTC |
Referencje
- https://lists.apache.org/thread/8p4jf02w54m22x0cwpq2x53w3ov8o557 ([email protected]) [Vendor Advisory, Mailing List]
- http://www.openwall.com/lists/oss-security/2026/09/23/31 (af854a3a-2127-422b-91ae-364da2661108) [Mailing List, Third Party Advisory]