CVE-2026-93446
—UnscoredPublished 20 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- —
- Complexity
- —
- Privileges needed
- —
- User interaction
- —
- Impact
- —
- Weakness
- CWE-459
Impact
Remote clients experience intermittent TLS 1.3 connection failures, leading to a partial denial of service for encrypted traffic. The issue triggers over network access to exposed Tomcat TLS endpoints.
Root cause
An incomplete cleanup bug in Tomcat's TLS session handling causes intermittent TLS 1.3 connection handshakes to fail.
Affected systems
Apache Tomcat 11.0.0-M21 through 11.0.26, 10.1.25 through 10.1.60, and 9.0.90 through 9.0.122
Fix & remediation
Upgrade to Apache Tomcat 11.0.27, 10.1.61, or 9.0.123 depending on your release branch. No interim workarounds are documented in the advisory.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently. This issue affects Apache Tomcat: from 11.0.0-M21 through 11.0.26, from 10.1.25 through 10.1.60, from 9.0.90 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.