Live › vulnerability › CVE-2026-93446
Go to dashboardApache Tomcat does not fully clean up state in its TLS 1.3 handling, so some connections fail intermittently. The sources describe a reliability failure and do not describe code execution or data exposure.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Apache Tomcat in the affected version ranges that serve TLS 1.3 connections are affected. The sources describe intermittent connection failures, not a security bypass. Teams on versions outside the listed ranges can skip it.
No product ranges from the sources yet.
catalina.sh version and compare it to the affected ranges: 11.0.0-M21 through 11.0.26, 10.1.25 through 10.1.60, 9.0.90 through 9.0.122.11.0.27.10.1.61.9.0.123.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently.
This issue affects Apache Tomcat: from 11.0.0-M21 through 11.0.26, from 10.1.25 through 10.1.60, from 9.0.90 through 9.0.122.
Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-93446")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.