{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-93446", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-09-17T22:18:31.729Z", "datePublished": "2026-10-20T13:44:35.673Z", "dateUpdated": "2026-10-20T18:10:09.969Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-10-20T13:44:35.673Z"}, "title": "Apache Tomcat: Possible TLS 1.3 connection failures", "problemTypes": [{"descriptions": [{"description": "CWE-459 Incomplete cleanup", "lang": "en", "cweId": "CWE-459", "type": "CWE"}]}], "source": {"discovery": "EXTERNAL"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Tomcat", "versions": [{"status": "affected", "version": "11.0.0-M21", "lessThanOrEqual": "11.0.26", "versionType": "semver"}, {"status": "affected", "version": "10.1.25", "lessThanOrEqual": "10.1.60", "versionType": "semver"}, {"status": "affected", "version": "9.0.90", "lessThanOrEqual": "9.0.122", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"value": "Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M21 through 11.0.26, from 10.1.25 through 10.1.60, from 9.0.90 through 9.0.122.\n\n\n\nUsers are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently.</p><p>This issue affects Apache Tomcat: from 11.0.0-M21 through 11.0.26, from 10.1.25 through 10.1.60, from 9.0.90 through 9.0.122.</p><p>Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.</p>"}]}], "references": [{"url": "https://lists.apache.org/thread.html/zh87okr5qspv4byzfpy2w6dqrokrnxzw", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "low"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "FHMTT (https://github.com/FHMTT)", "type": "finder"}], "x_generator": {"engine": "Vulnogram 1.0.3"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/10/20/25"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-20T18:10:09.969Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Apache Tomcat", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "11.0.26", "status": "affected", "version": "11.0.0-M21", "versionType": "semver"}, {"lessThanOrEqual": "10.1.60", "status": "affected", "version": "10.1.25", "versionType": "semver"}, {"lessThanOrEqual": "9.0.122", "status": "affected", "version": "9.0.90", "versionType": "semver"}]}], "source": "security@apache.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M21 through 11.0.26, from 10.1.25 through 10.1.60, from 9.0.90 through 9.0.122.\n\n\n\nUsers are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue."}], "id": "CVE-2026-93446", "lastModified": "2026-10-20T19:35:38.940", "metrics": {}, "published": "2026-10-20T14:17:04.473", "references": [{"source": "security@apache.org", "url": "https://lists.apache.org/thread.html/zh87okr5qspv4byzfpy2w6dqrokrnxzw"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/10/20/25"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-459"}], "source": "security@apache.org", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2026:81365", "cpe": "cpe:/a:redhat:hummingbird:1", "package": "tomcat11-main-11.0.27-0.1.hum1", "product_name": "Red Hat Hardened Images", "release_date": "2026-10-12T00:00:00Z"}, {"advisory": "RHSA-2026:85926", "cpe": "cpe:/a:redhat:hummingbird:1", "package": "tomcat10-main-10.1.61-0.1.hum1", "product_name": "Red Hat Hardened Images", "release_date": "2026-10-20T00:00:00Z"}], "bugzilla": {"description": "tomcat: Apache Tomcat: Possible TLS 1.3 connection failures", "id": "2556181", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556181"}, "csaw": false, "cwe": "CWE-459", "details": ["A flaw was found in Apache Tomcat. An incomplete cleanup vulnerability can cause Transport Layer Security (TLS) 1.3 connections to fail intermittently. This issue may prevent remote clients from establishing secure connections, resulting in an intermittent Denial of Service (DoS)."], "name": "CVE-2026-93446", "public_date": "2026-10-20T13:44:35Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-93446\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-93446\nhttps://lists.apache.org/thread.html/zh87okr5qspv4byzfpy2w6dqrokrnxzw"], "threat_severity": "Moderate"}