CVE-2026-86243
Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash.
CVSS
7.5
Alto
EPSS
—
KEV
—
Exploit Today
0
0-100
Publicado: 23 sept 2026 · Última mod.: 23 sept 2026 · CWE-126
Sin historial EPSS suficiente todavía.
Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versions may also be affected. Users are recommended to upgrade to version 1.3.9 or 2.0.16, which fix the issue.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-252947.4 ALT0.9%
——0Transient DOS while parsing frame during channel usage.1dCVE-2026-252847.3 ALT0.0%
——0Information Disclosure when a pointer is reused after being deallocated.1dCVE-2026-252757.5 ALT9.0%
——3Transient DOS when processing authentication frames with invalid FILS information element header lengths.1dCVE-2026-240817.4 ALT0.9%
——0Transient DOS when processing a channel map with insufficient used channels and adaptive frequency hopping is fully enabled.1dCVE-2026-240757.8 ALT0.0%
——0Memory Corruption when multiple threads issue concurrent IOCTL requests to the device control handler due to improper synchronization and race conditions.1dCVE-2026-906103.3 BAJ1.9%
——1A vulnerability was found in GPAC up to f1219cde. This affects the function gf_svg_attributes_copy of the file scenegraph/svg_attributes.c of the component MP4Box. Performing a manipulation results in buffer over-read. The attack is only possible with local access. The exploit has been made public and could be used. Upgrading to version abi-16.23 mitigates this issue. The patch is named afca1f1181668d85941d51ed1adf647807d5d975. Upgrading the affected component is recommended.8d