CVE-2026-93446
Received Received - Intake

Incomplete Cleanup Flaw in Apache Tomcat Causes TLS 1.3 Failures

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: Apache Software Foundation

Description
Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently. This issue affects Apache Tomcat: from 11.0.0-M21 through 11.0.26, from 10.1.25 through 10.1.60, from 9.0.90 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-93446
EUVD
EUVD-2026-105008

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Apache Software Foundation Apache Tomcat 11.0.0-M21
Apache Software Foundation Apache Tomcat 10.1.25
Apache Software Foundation Apache Tomcat 9.0.90

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-459 The product does not properly "clean up" and remove temporary or supporting resources after they have been used.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an incomplete cleanup vulnerability in Apache Tomcat that causes TLS 1.3 connections to fail intermittently. It affects specific versions of Tomcat between certain ranges.

Detection Guidance

This vulnerability causes TLS 1.3 connections to fail intermittently. Monitor Tomcat logs for connection failures or errors related to TLS 1.3 handshakes. Check Tomcat version to confirm if it falls within the affected range (11.0.0-M21 through 11.0.26, 10.1.25 through 10.1.60, 9.0.90 through 9.0.122).

Impact Analysis

The vulnerability can cause TLS 1.3 connections to fail intermittently, potentially disrupting secure communications between clients and the server. This may lead to failed handshakes and interrupted encrypted sessions.

Mitigation Strategies

Upgrade Apache Tomcat to a fixed version: 11.0.27, 10.1.61, or 9.0.123 or later. Restart the Tomcat service after upgrading to apply changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93446. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart