Apache Tomcat Native vulnerabilities

8 CVEs affecting Apache Tomcat Native, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-86247, published 2026-09-23.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-8020, published 2018-07-31. High severity, CVSS 7.4. EPSS: 4.1% chance of exploitation in the next 30 days. Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 has a flaw that does not properly check OCSP pre-produced responses, which are lists (multiple entries) of certificate statuses.…
CVE-2018-8019, published 2018-07-31. High severity, CVSS 7.4. EPSS: 4% chance of exploitation in the next 30 days. When using an OCSP responder Apache Tomcat Native 1.2.0 to 1.2.16 and 1.1.23 to 1.1.34 did not correctly handle invalid responses. This allowed for revoked client certificates to be incorrectly…
CVE-2017-15698, published 2018-01-31. Medium severity, CVSS 5.9. EPSS: 3.5% chance of exploitation in the next 30 days. When parsing the AIA-Extension field of a client certificate, Apache Tomcat Native Connector 1.2.0 to 1.2.14 and 1.1.23 to 1.1.34 did not correctly handle fields longer than 127 bytes. The result of…
CVE-2026-29145, published 2026-04-09. Critical severity, CVSS 9.1. EPSS: 0.7% chance of exploitation in the next 30 days. CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native. This issue affects Apache Tomcat: from…
CVE-2026-86243, published 2026-09-23. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects Apache Tomcat Native: from 2.0.0…
CVE-2026-24734, published 2026-02-17. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat. When using an OCSP responder, Tomcat Native (and Tomcat's FFM port of the Tomcat Native code) did not complete…
CVE-2026-86246, published 2026-09-23. Critical severity, CVSS 9.1. EPSS: 0.4% chance of exploitation in the next 30 days. Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET,…
CVE-2026-86247, published 2026-09-23. High severity, CVSS 7.4. EPSS: 0.2% chance of exploitation in the next 30 days. Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations. This issue affects Apache…