Incomplete cleanup in Apache Tomcat - CVE-2026-93446
Published: October 20, 2026
Vulnerability identifier: #VU156274
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-93446
CWE-ID: CWE-459
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause intermittent TLS 1.3 connection failures, disrupting access to the service.
The vulnerability exists due to incomplete cleanup in Apache Tomcat TLS connection handling when processing TLS 1.3 connections. A remote attacker can trigger affected connection handling to cause intermittent connection failures.
Affected software
Apache Tomcat
How to mitigate CVE-2026-93446
Install security update from vendor's website.
Apache Tomcat - addressed in versions 9.0.123, 10.1.61, 11.0.27