CVE-2026-86243

Katalog CVE

CVSS 7.5 · High EPSS 0,61%

Kerentanan Buffer Over-read pada apache tomcat native. Skor CVSS 3.1 7.5 (High) menurut CISA ADP.

Deskripsi (NVD)

Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versions may also be affected. Users are recommended to upgrade to version 1.3.9 or 2.0.16, which fix the issue.

Rincian

Terbit di NVD

23 September 2026

Terakhir diubah

6 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-126: Buffer Over-read

EPSS (30 hari)

0,61% peluang dieksploitasi; lebih tinggi dari 47,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/8p4jf02w54m22x0cwpq2x53w3ov8o557 advisory vendor · mailing list
• http://www.openwall.com/lists/oss-security/2026/09/23/31 mailing list · advisory pihak ketiga