Incomplete Cleanup Vulnerability in Apache Tomcat Software by Apache
CVE-2026-93446

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Tomcat
Vendor
CVE Published:
20 October 2026

What is CVE-2026-93446?

An incomplete cleanup vulnerability in Apache Tomcat can lead to intermittent failures in TLS 1.3 connections, potentially affecting secure communications. This issue impacts multiple versions of the software. Users are strongly advised to update to the latest versions: 11.0.27, 10.1.61, or 9.0.123 to mitigate this vulnerability effectively.

Affected Version(s)

Apache Tomcat 11.0.0-M21 <= 11.0.26

Apache Tomcat 10.1.25 <= 10.1.60

Apache Tomcat 9.0.90 <= 9.0.122

References

https://lists.apache.org/thread.html/zh87okr5qspv4byzfpy2...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

FHMTT (https://github.com/FHMTT)
.