Security update for libtcnative-2-0
This update for libtcnative-2-0 fixes the following issues: - CVE-2026-86243: buffer overread during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash (bsc#1282623). - CVE-2026-86246: insecure ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX options enabled by default (bsc#1282622). - CVE-2026-86247: race condition allows client certificate verification requirements to be down-graded for some configurations (bsc#1282621). Changes for libtcnative-2-0: - Upgrade to version 2.0.16 * Security fixes + Client certificate requirements can be down-graded (bsc#1282621, CVE-2026-86247) A race condition allowed client certificate verification requirements to be down-graded for some configurations. + Insecure OpenSSL options enabled (bsc#1282622, CVE-2026-86246) Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX. + DoS via TLS handshake (bsc#1282623, CVE-2026-86243) A buffer over-read vulnerability in Apache Tomcat Native during the TLS handshaking permits a malicious user to trigger a DoS via a JVM crash. * Changes + Code: Remove call to ERR_remove_thread_state() from Windows specific code to allow building with OpenSSL 4.0.x ERR_remove_thread_state() is a no-op in OpenSSL 1.1+ and got removed in OpenSSL 4 + Update: Remove support for Windows build on IA64 architecture (Itanium) + Update: Make x64 the
- Products
- libtcnative-2-0
- Affected versions
- Not specified
- Fixed versions
- 2.0.16-150400.9.6.1
- CVEs
- CVE-2026-86243, CVE-2026-86246, CVE-2026-86247
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 30 Oct 2026, 12:37 UTC · Revision 1
Source evidence
This update for libtcnative-2-0 fixes the following issues: - CVE-2026-86243: buffer overread during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash (bsc#1282623). - CVE-2026-86246: insecure ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX options enabled by default (bsc#1282622). - CVE-2026-86247: race condition allows client certificate verification requirements to be down-graded for some configurations (bsc#1282621). Changes for libtcnative-2-0: - Upgrade to version 2.0.16 * Security fixes + Client certificate requirements can be down-graded (bsc#1282621, CVE-2026-86247) A race condition allowed client certificate verification requirements to be down-graded for some configurations. + Insecure OpenSSL options enabled (bsc#1282622, CVE-2026-86246) Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX. + DoS via TLS handshake (bsc#1282623, CVE-2026-86243) A buffer over-read vulnerability in Apache Tomcat Native during the TLS handshaking permits a malicious user to trigger a DoS via a JVM crash. * Changes + Code: Remove call to ERR_remove_thread_state() from Windows specific code to allow building with OpenSSL 4.0.x ERR_remove_thread_state() is a no-op in OpenSSL 1.1+ and got removed in OpenSSL 4 + Update: Remove support for Windows build on IA64 architecture (Itanium) + Update: Make x64 the
osv:SUSE-SU-2026:4658-1
libtcnative-2-0
Fixed versions: 2.0.16-150400.9.6.1
libtcnative-2-0
Fixed versions: 2.0.16-150400.9.6.1
libtcnative-2-0
Fixed versions: 2.0.16-150400.9.6.1
libtcnative-2-0
Fixed versions: 2.0.16-150400.9.6.1
libtcnative-2-0
Fixed versions: 2.0.16-150400.9.6.1
libtcnative-2-0
Fixed versions: 2.0.16-150400.9.6.1
libtcnative-2-0
Fixed versions: 2.0.16-150400.9.6.1
libtcnative-2-0
Fixed versions: 2.0.16-150400.9.6.1
libtcnative-2-0
Fixed versions: 2.0.16-150400.9.6.1
libtcnative-2-0
Fixed versions: 2.0.16-150400.9.6.1
libtcnative-2-0
Fixed versions: 2.0.16-150400.9.6.1
libtcnative-2-0
Fixed versions: 2.0.16-150400.9.6.1
Complete source record
{
"id": "7adbef1838a48b7cf0ab5ff78602c4d9b625e395fbe860f7bd8c1bb70d94e6db",
"url": "https://osv.dev/vulnerability/SUSE-SU-2026%3A4658-1",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Security update for libtcnative-2-0",
"summary": "This update for libtcnative-2-0 fixes the following issues: - CVE-2026-86243: buffer overread during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash (bsc#1282623). - CVE-2026-86246: insecure ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX options enabled by default (bsc#1282622). - CVE-2026-86247: race condition allows client certificate verification requirements to be down-graded for some configurations (bsc#1282621). Changes for libtcnative-2-0: - Upgrade to version 2.0.16 * Security fixes + Client certificate requirements can be down-graded (bsc#1282621, CVE-2026-86247) A race condition allowed client certificate verification requirements to be down-graded for some configurations. + Insecure OpenSSL options enabled (bsc#1282622, CVE-2026-86246) Apache Tomcat Native enabled insecure options by default including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX. + DoS via TLS handshake (bsc#1282623, CVE-2026-86243) A buffer over-read vulnerability in Apache Tomcat Native during the TLS handshaking permits a malicious user to trigger a DoS via a JVM crash. * Changes + Code: Remove call to ERR_remove_thread_state() from Windows specific code to allow building with OpenSSL 4.0.x ERR_remove_thread_state() is a no-op in OpenSSL 1.1+ and got removed in OpenSSL 4 + Update: Remove support for Windows build on IA64 architecture (Itanium) + Update: Make x64 the",
"evidence": "osv:SUSE-SU-2026:4658-1",
"products": [
{
"name": {
"value": "libtcnative-2-0",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.0.16-150400.9.6.1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libtcnative-2-0",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.0.16-150400.9.6.1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libtcnative-2-0",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.0.16-150400.9.6.1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libtcnative-2-0",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.0.16-150400.9.6.1",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libtcnative-2-0",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.0.16-150400.9.6.1",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libtcnative-2-0",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.0.16-150400.9.6.1",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libtcnative-2-0",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.0.16-150400.9.6.1",
"evidence": "/affected/6/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libtcnative-2-0",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.0.16-150400.9.6.1",
"evidence": "/affected/7/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libtcnative-2-0",
"evidence": "/affected/8/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.0.16-150400.9.6.1",
"evidence": "/affected/8/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libtcnative-2-0",
"evidence": "/affected/9/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.0.16-150400.9.6.1",
"evidence": "/affected/9/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libtcnative-2-0",
"evidence": "/affected/10/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.0.16-150400.9.6.1",
"evidence": "/affected/10/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libtcnative-2-0",
"evidence": "/affected/11/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.0.16-150400.9.6.1",
"evidence": "/affected/11/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "SUSE-SU-2026:4658-1",
"aliases": [
"SUSE-SU-2026:4658-1"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.16-150400.9.6.1"
}
]
}
],
"package": {
"name": "libtcnative-2-0",
"purl": "pkg:rpm/suse/libtcnative-2-0&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP7",
"ecosystem": "SUSE:Linux Enterprise Module for Basesystem 15 SP7"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4658-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"libtcnative-2-0": "2.0.16-150400.9.6.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.16-150400.9.6.1"
}
]
}
],
"package": {
"name": "libtcnative-2-0",
"purl": "pkg:rpm/suse/libtcnative-2-0&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Web%20and%20Scripting%2015%20SP7",
"ecosystem": "SUSE:Linux Enterprise Module for Web and Scripting 15 SP7"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4658-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"libtcnative-2-0-devel": "2.0.16-150400.9.6.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.16-150400.9.6.1"
}
]
}
],
"package": {
"name": "libtcnative-2-0",
"purl": "pkg:rpm/suse/libtcnative-2-0&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS",
"ecosystem": "SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4658-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"libtcnative-2-0": "2.0.16-150400.9.6.1",
"libtcnative-2-0-devel": "2.0.16-150400.9.6.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.16-150400.9.6.1"
}
]
}
],
"package": {
"name": "libtcnative-2-0",
"purl": "pkg:rpm/suse/libtcnative-2-0&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS",
"ecosystem": "SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4658-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"libtcnative-2-0": "2.0.16-150400.9.6.1",
"libtcnative-2-0-devel": "2.0.16-150400.9.6.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.16-150400.9.6.1"
}
]
}
],
"package": {
"name": "libtcnative-2-0",
"purl": "pkg:rpm/suse/libtcnative-2-0&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS",
"ecosystem": "SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4658-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"libtcnative-2-0": "2.0.16-150400.9.6.1",
"libtcnative-2-0-devel": "2.0.16-150400.9.6.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.16-150400.9.6.1"
}
]
}
],
"package": {
"name": "libtcnative-2-0",
"purl": "pkg:rpm/suse/libtcnative-2-0&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS",
"ecosystem": "SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4658-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"libtcnative-2-0": "2.0.16-150400.9.6.1",
"libtcnative-2-0-devel": "2.0.16-150400.9.6.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.16-150400.9.6.1"
}
]
}
],
"package": {
"name": "libtcnative-2-0",
"purl": "pkg:rpm/suse/libtcnative-2-0&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS",
"ecosystem": "SUSE:Linux Enterprise Server 15 SP4-LTSS"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4658-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"libtcnative-2-0": "2.0.16-150400.9.6.1",
"libtcnative-2-0-devel": "2.0.16-150400.9.6.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.16-150400.9.6.1"
}
]
}
],
"package": {
"name": "libtcnative-2-0",
"purl": "pkg:rpm/suse/libtcnative-2-0&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS",
"ecosystem": "SUSE:Linux Enterprise Server 15 SP5-LTSS"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4658-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"libtcnative-2-0": "2.0.16-150400.9.6.1",
"libtcnative-2-0-devel": "2.0.16-150400.9.6.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.16-150400.9.6.1"
}
]
}
],
"package": {
"name": "libtcnative-2-0",
"purl": "pkg:rpm/suse/libtcnative-2-0&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS",
"ecosystem": "SUSE:Linux Enterprise Server 15 SP6-LTSS"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4658-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"libtcnative-2-0": "2.0.16-150400.9.6.1",
"libtcnative-2-0-devel": "2.0.16-150400.9.6.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.16-150400.9.6.1"
}
]
}
],
"package": {
"name": "libtcnative-2-0",
"purl": "pkg:rpm/suse/libtcnative-2-0&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4",
"ecosystem": "SUSE:Linux Enterprise Server for SAP Applications 15 SP4"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4658-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"libtcnative-2-0": "2.0.16-150400.9.6.1",
"libtcnative-2-0-devel": "2.0.16-150400.9.6.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.16-150400.9.6.1"
}
]
}
],
"package": {
"name": "libtcnative-2-0",
"purl": "pkg:rpm/suse/libtcnative-2-0&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5",
"ecosystem": "SUSE:Linux Enterprise Server for SAP Applications 15 SP5"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4658-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"libtcnative-2-0": "2.0.16-150400.9.6.1",
"libtcnative-2-0-devel": "2.0.16-150400.9.6.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.16-150400.9.6.1"
}
]
}
],
"package": {
"name": "libtcnative-2-0",
"purl": "pkg:rpm/suse/libtcnative-2-0&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6",
"ecosystem": "SUSE:Linux Enterprise Server for SAP Applications 15 SP6"
},
"database_specific": {
"source": "https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4658-1.json"
},
"ecosystem_specific": {
"binaries": [
{
"libtcnative-2-0": "2.0.16-150400.9.6.1",
"libtcnative-2-0-devel": "2.0.16-150400.9.6.1"
}
]
}
}
],
"modified": "2026-10-14T17:30:07.609803909Z",
"provider": "osv",
"upstream": [
"CVE-2026-86243",
"CVE-2026-86246",
"CVE-2026-86247"
],
"references": [
"https://www.suse.com/support/update/announcement/2026/suse-su-20264658-1/",
"https://bugzilla.suse.com/1282621",
"https://bugzilla.suse.com/1282622",
"https://bugzilla.suse.com/1282623",
"https://www.suse.com/security/cve/CVE-2026-86243",
"https://www.suse.com/security/cve/CVE-2026-86246",
"https://www.suse.com/security/cve/CVE-2026-86247"
]
},
"related_cves": [
{
"value": "CVE-2026-86243",
"evidence": "/upstream"
},
{
"value": "CVE-2026-86246",
"evidence": "/upstream"
},
{
"value": "CVE-2026-86247",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 317518,
"published_at": "2026-10-14T07:51:18+00:00"
}