Vulnpedia
← Search CVEs

CVE-2026-93446

N/A

Published 2026-10-20 · Last modified 2026-10-20

Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently. This issue affects Apache Tomcat: from 11.0.0-M21 through 11.0.26, from 10.1.25 through 10.1.60, from 9.0.90 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.

NO EXPLOITATION SIGNALS

No known exploitation, public exploit, or elevated probability at this time. Track for changes.

Exploitation likelihood

0.3%chance of exploitation in 30 days · 16th percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

—CVSS · not scored

  • No impact metrics

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Apache Software Foundation

Products Apache Tomcat

Weakness (CWE)

  • CWE-459: Incomplete cleanup

CVSS vector

Not yet scored.

References and research data (JSON)

Vendor product assessments

Showing 32 of 153 vendor product statements; 121 omitted. Read the full vendor advisory.

  • tomcat10-0:10.1.61-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer.
    Red Hat · CVE-2026-93446 · Updated 2026-10-22T21:10:56+00:00
  • tomcat10-admin-webapps-0:10.1.61-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer.
    Red Hat · CVE-2026-93446 · Updated 2026-10-22T21:10:56+00:00
  • tomcat10-common-0:10.1.61-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer.
    Red Hat · CVE-2026-93446 · Updated 2026-10-22T21:10:56+00:00
  • tomcat10-docs-webapp-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer.
    Red Hat · CVE-2026-93446 · Updated 2026-10-22T21:10:56+00:00
  • tomcat10-jsp-3.1-api-0:10.1.61-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer.
    Red Hat · CVE-2026-93446 · Updated 2026-10-22T21:10:56+00:00
  • tomcat10-lib-0:10.1.61-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer.
    Red Hat · CVE-2026-93446 · Updated 2026-10-22T21:10:56+00:00
  • tomcat10-servlet-6.0-api-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer.
    Red Hat · CVE-2026-93446 · Updated 2026-10-22T21:10:56+00:00
  • tomcat10-webapps-0:10.1.61-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer.
    Red Hat · CVE-2026-93446 · Updated 2026-10-22T21:10:56+00:00
  • tomcat11-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer.
    Red Hat · CVE-2026-93446 · Updated 2026-10-22T21:10:56+00:00
  • tomcat11-admin-webapps-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer.
    Red Hat · CVE-2026-93446 · Updated 2026-10-22T21:10:56+00:00
  • tomcat11-docs-webapp-0:11.0.27-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer.
    Red Hat · CVE-2026-93446 · Updated 2026-10-22T21:10:56+00:00
  • tomcat11-el-6.0-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer.
    Red Hat · CVE-2026-93446 · Updated 2026-10-22T21:10:56+00:00
  • tomcat11-jsp-4.0-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer.
    Red Hat · CVE-2026-93446 · Updated 2026-10-22T21:10:56+00:00
  • tomcat11-servlet-6.1-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer.
    Red Hat · CVE-2026-93446 · Updated 2026-10-22T21:10:56+00:00
  • tomcat11-user-instance-0:11.0.27-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer.
    Red Hat · CVE-2026-93446 · Updated 2026-10-22T21:10:56+00:00
  • tomcat11-webapps-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer.
    Red Hat · CVE-2026-93446 · Updated 2026-10-22T21:10:56+00:00
  • tomcat as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat

    • workaround: Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer.
    • none available: Fix deferred
    Red Hat · CVE-2026-93446 · Updated 2026-10-22T21:10:56+00:00
  • tomcat-servlet-6.0-api as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat-servlet-6.0-api

    • workaround: Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer.
    • none available: Fix deferred
    Red Hat · CVE-2026-93446 · Updated 2026-10-22T21:10:56+00:00
  • tomcat9-jsp-2.3-api as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat9-jsp-2.3-api

    • workaround: Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer.
    • none available: Fix deferred
    Red Hat · CVE-2026-93446 · Updated 2026-10-22T21:10:56+00:00
  • tomcat6-admin-webapps as a component of Red Hat Enterprise Linux 6 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat6-admin-webapps

    • workaround: Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer.
    • none available: Fix deferred
    Red Hat · CVE-2026-93446 · Updated 2026-10-22T21:10:56+00:00
  • tomcat6-log4j as a component of Red Hat Enterprise Linux 6 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat6-log4j

    • workaround: Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer.
    • none available: Fix deferred
    Red Hat · CVE-2026-93446 · Updated 2026-10-22T21:10:56+00:00
  • tomcat-el-2.2-api as a component of Red Hat Enterprise Linux 7 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat-el-2.2-api

    • workaround: Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer.
    • none available: Fix deferred
    Red Hat · CVE-2026-93446 · Updated 2026-10-22T21:10:56+00:00
  • tomcat-webapps as a component of Red Hat Enterprise Linux 7 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat-webapps

    • workaround: Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer.
    • none available: Fix deferred
    Red Hat · CVE-2026-93446 · Updated 2026-10-22T21:10:56+00:00
  • tomcat-admin-webapps as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat-admin-webapps

    • workaround: Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer.
    • none available: Fix deferred
    Red Hat · CVE-2026-93446 · Updated 2026-10-22T21:10:56+00:00
  • tomcat.src as a component of Red Hat Enterprise Linux 8 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat?arch=src

    • workaround: Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer.
    • none available: Fix deferred
    Red Hat · CVE-2026-93446 · Updated 2026-10-22T21:10:56+00:00
  • tomcat-docs-webapp as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/tomcat-docs-webapp

    • workaround: Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer.
    • none available: Fix deferred
    Red Hat · CVE-2026-93446 · Updated 2026-10-22T21:10:56+00:00
  • jws5-tomcat as a component of Red Hat JBoss Web Server 5 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/jws5-tomcat

    • workaround: Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer.
    • none available: Fix deferred
    Red Hat · CVE-2026-93446 · Updated 2026-10-22T21:10:56+00:00
  • jws5-tomcat-javadoc as a component of Red Hat JBoss Web Server 5 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/jws5-tomcat-javadoc

    • workaround: Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer.
    • none available: Fix deferred
    Red Hat · CVE-2026-93446 · Updated 2026-10-22T21:10:56+00:00
  • jws5-tomcat-webapps as a component of Red Hat JBoss Web Server 5 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/jws5-tomcat-webapps

    • workaround: Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer.
    • none available: Fix deferred
    Red Hat · CVE-2026-93446 · Updated 2026-10-22T21:10:56+00:00
  • jws6-tomcat-jsp-3.1-api as a component of Red Hat JBoss Web Server 6 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/jws6-tomcat-jsp-3.1-api

    • workaround: Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer.
    • none available: Fix deferred
    Red Hat · CVE-2026-93446 · Updated 2026-10-22T21:10:56+00:00
  • jws7-tomcat.src as a component of Red Hat JBoss Web Server 7 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/jws7-tomcat?arch=src

    • workaround: Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer.
    • none available: Fix deferred
    Red Hat · CVE-2026-93446 · Updated 2026-10-22T21:10:56+00:00
  • hi/tomcat as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/tomcat?repository_url=registry.redhat.io/hi/tomcat

    Red Hat · CVE-2026-93446 · Updated 2026-10-22T21:10:56+00:00

References

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS