2539393 – (CVE-2026-86247) CVE-2026-86247 tomcat-native: Apache Tomcat Native: Client certificate verification requirements can be down-graded via race condition

Bug 2539393 (CVE-2026-86247) - CVE-2026-86247 tomcat-native: Apache Tomcat Native: Client certificate verification requirements can be down-graded via race condition

Summary: CVE-2026-86247 tomcat-native: Apache Tomcat Native: Client certificate verifi...

Keywords:
Status:	NEW
Alias:	CVE-2026-86247
Product:	Security Response
Classification:	Other
Component:	vulnerability
Sub Component:
Version:	unspecified
Hardware:	All
OS:	Linux
Priority:	medium
Severity:	medium
Target Milestone:	---
Assignee:	Product Security DevOps Team
QA Contact:
Docs Contact:
URL:
Whiteboard:
Depends On:	2542947 2542948
Blocks:
TreeView+	depends on / blocked

Reported:	2026-09-23 12:52 UTC by OSIDB Bzimport
Modified:	2026-11-09 17:36 UTC (History)
CC List:	8 users (show)
Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments	(Terms of Use)

Links
System	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2026:93618	None	None	None	2026-11-03 13:51:24 UTC
Red Hat Product Errata	RHSA-2026:93622	None	None	None	2026-11-03 13:50:01 UTC
Red Hat Product Errata	RHSA-2026:96228	None	None	None	2026-11-09 17:36:52 UTC
Red Hat Product Errata	RHSA-2026:96229	None	None	None	2026-11-09 17:33:02 UTC

Description OSIDB Bzimport 2026-09-23 12:52:25 UTC

Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations.



This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be affected.



Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fixes the issue.

Comment 3 Jon Orris 2026-11-03 13:50:00 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Web Server 7.0.3

Via RHSA-2026:93622 https://access.redhat.com/errata/RHSA-2026:93622

Comment 4 Jon Orris 2026-11-03 13:51:23 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Web Server 7.0 on RHEL 10
  Red Hat JBoss Web Server 7.0 on RHEL 8
  Red Hat JBoss Web Server 7.0 on RHEL 9

Via RHSA-2026:93618 https://access.redhat.com/errata/RHSA-2026:93618

Comment 5 errata-xmlrpc 2026-11-09 17:33:00 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Web Server 6.2.6

Via RHSA-2026:96229 https://access.redhat.com/errata/RHSA-2026:96229

Comment 6 errata-xmlrpc 2026-11-09 17:36:46 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Web Server 6.2 on RHEL 10
  Red Hat JBoss Web Server 6.2 on RHEL 8
  Red Hat JBoss Web Server 6.2 on RHEL 9

Via RHSA-2026:96228 https://access.redhat.com/errata/RHSA-2026:96228

Note You need to log in before you can comment on or make changes to this bug.