Apache Tomcat TLS1.3 Fail Incomplete Cleanup (pre-11.0.27/10.1.61/9.0.123)
CVE-2026-93446 Published on October 20, 2026
Apache Tomcat: Possible TLS 1.3 connection failures
Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently.
This issue affects Apache Tomcat: from 11.0.0-M21 through 11.0.26, from 10.1.25 through 10.1.60, from 9.0.90 through 9.0.122.
Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.
Weakness Type
What is an Insufficient Cleanup Vulnerability?
The software does not properly "clean up" and remove temporary or supporting resources after they have been used.
CVE-2026-93446 has been classified to as an Insufficient Cleanup vulnerability or weakness.
Products Associated with CVE-2026-93446
Want to know whenever a new CVE is published for Apache Tomcat? stack.watch will email you.
Affected Versions
Apache Software Foundation Apache Tomcat:- Version 11.0.0-M21, <= 11.0.26 is affected.
- Version 10.1.25, <= 10.1.60 is affected.
- Version 9.0.90, <= 9.0.122 is affected.