ALAS2027-2026-206

References: CVE-2026-86246  CVE-2026-86247  CVE-2026-86243 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

Package updates are available for Amazon Linux 2027 that fix the following vulnerabilities:
CVE-2026-86247:
Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations.

This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be affected.

Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fixes the issue.

CVE-2026-86246:
Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX.

This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier unsupported versions may also be affected.

Users are recommended to upgrade to version 2.0.16 or 1.3.9, which fix the issue.

CVE-2026-86243:
Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash.

This issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versions may also be affected.

Users are recommended to upgrade to version 1.3.9 or 2.0.16, which fix the issue.

Issue Correction:
Run dnf update tomcat-native or dnf update --advisory ALAS2027-2026-206 to update your system.

New Packages:

aarch64:
    tomcat-native-debugsource-2.0.16-1.amzn2027.0.1.aarch64
    tomcat-native-debuginfo-2.0.16-1.amzn2027.0.1.aarch64
    tomcat-native-2.0.16-1.amzn2027.0.1.aarch64

src:
    tomcat-native-2.0.16-1.amzn2027.0.1.src

x86_64:
    tomcat-native-debuginfo-2.0.16-1.amzn2027.0.1.x86_64
    tomcat-native-2.0.16-1.amzn2027.0.1.x86_64
    tomcat-native-debugsource-2.0.16-1.amzn2027.0.1.x86_64