The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX.
This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier unsupported versions may also be affected.
Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fix the issue.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade tomcat-native | Oct 28, 2026 | Sep 23, 2026 |
| Amazon_linux_2023 | — | Upgrade tomcat-native-debugsourceUpgrade tomcat-native-debuginfoUpgrade tomcat-native | Oct 13, 2026 | Sep 23, 2026 |
| Redhat_linux | — | Upgrade jws7-tomcat-javadocUpgrade jws7-mod_cluster-tomcatUpgrade jws7-mod_clusterUpgrade jws7-tomcat-selinuxUpgrade jws7-tomcat-servlet-6.0-apiUpgrade jws7-tomcat-docs-webappUpgrade jws7-tomcat-libUpgrade jws7-tomcat-native-debuginfoUpgrade jws7-tomcat-admin-webappsUpgrade jws7-tomcatUpgrade jws7-tomcat-webappsUpgrade jws7-tomcat-el-5.0-apiUpgrade jws7-tomcat-jsp-3.1-apiUpgrade jws7-tomcat-native | Nov 5, 2026 | Sep 23, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub