Apache Tomcat Native initializes OpenSSL with insecure defaults that enable options such as ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF, and ALLOW_NO_DHE_KEX. These settings can allow an attacker to downgrade TLS connections, force "no extended master secret" exchanges, or bypass key‑exchange checks, potentially compromising the confidentiality and integrity of encrypted traffic.

The vulnerability affects Apache Tomcat Native versions 2.0.0 through 2.0.15 and 1.3.0 through 1.3.8. Earlier, unsupported releases may also be vulnerable. Users running any of these versions should consider upgrading to a fixed release.

EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. No CVSS score is provided in the advisory, so the severity cannot be quantified precisely. The impact could be significant because insecure defaults are enabled automatically, meaning any TLS connection could be exploited without further configuration by the attacker. The lack of official exploitation guidance suggests that practical attack conditions are unclear, but the potential for downgrade or man‑in‑the‑middle attacks warrants prompt action.