Apache Tomcat TLS1.3 Fail Incomplete Cleanup (pre-11.0.27/10.1.61/9.0.123)
CVE-2026-93446 Published on October 20, 2026
Apache Tomcat: Possible TLS 1.3 connection failures
Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently.
This issue affects Apache Tomcat: from 11.0.0-M21 through 11.0.26, from 10.1.25 through 10.1.60, from 9.0.90 through 9.0.122.
Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.
Vulnerability Analysis
CVE-2026-93446 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.
Weakness Type
What is an Insufficient Cleanup Vulnerability?
The software does not properly "clean up" and remove temporary or supporting resources after they have been used.
CVE-2026-93446 has been classified to as an Insufficient Cleanup vulnerability or weakness.
Products Associated with CVE-2026-93446
Want to know whenever a new CVE is published for Apache Tomcat? stack.watch will email you.
Affected Versions
Apache Software Foundation Apache Tomcat:- Version 11.0.0-M21, <= 11.0.26 is affected.
- Version 10.1.25, <= 10.1.60 is affected.
- Version 9.0.90, <= 9.0.122 is affected.