ALAS2023-2026-3167

Amazon Linux 2023 Security Advisory: ALAS2023-2026-3167
Advisory Released Date: 2026-10-12
Advisory Updated Date: 2026-10-12
Severity: Important
Issue Overview:

Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash.

This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versions may also be affected.

Users are recommended to upgrade to version 1.3.9 or 2.0.16, which fix the issue. (CVE-2026-86243)

Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX.

This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier unsupported versions may also be affected.

Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fix the issue. (CVE-2026-86246)

Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations.

This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be affected.

Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fixes the issue. (CVE-2026-86247)


Affected Packages:

tomcat-native


Issue Correction:
Run dnf update tomcat-native --releasever 2023.12.20261012 or dnf update --advisory ALAS2023-2026-3167 --releasever 2023.12.20261012 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:
aarch64:
    tomcat-native-debuginfo-2.0.16-1.amzn2023.0.1.aarch64
    tomcat-native-debugsource-2.0.16-1.amzn2023.0.1.aarch64
    tomcat-native-2.0.16-1.amzn2023.0.1.aarch64

src:
    tomcat-native-2.0.16-1.amzn2023.0.1.src

x86_64:
    tomcat-native-2.0.16-1.amzn2023.0.1.x86_64
    tomcat-native-debugsource-2.0.16-1.amzn2023.0.1.x86_64
    tomcat-native-debuginfo-2.0.16-1.amzn2023.0.1.x86_64

Additional References

Release Notes:  Amazon Linux 2023 Release Notes

Red Hat: CVE-2026-86243, CVE-2026-86246, CVE-2026-86247

Mitre: CVE-2026-86243, CVE-2026-86246, CVE-2026-86247