{"schema":"vulnpedia.research/1","cve":"CVE-2026-93446","generated":"2026-10-26T13:52:32.101Z","references":[{"url":"https://lists.apache.org/thread.html/zh87okr5qspv4byzfpy2w6dqrokrnxzw","tags":["vendor-advisory","vendor-reference"],"source":"mitre","sourceId":"apache","modified":"2026-10-20T13:44:35.673Z","origins":[{"source":"mitre","sourceId":"apache","modified":"2026-10-20T13:44:35.673Z","url":"https://lists.apache.org/thread.html/zh87okr5qspv4byzfpy2w6dqrokrnxzw"},{"source":"nvd","sourceId":"CVE-2026-93446","modified":"2026-10-20T19:35:38.940","url":"https://lists.apache.org/thread.html/zh87okr5qspv4byzfpy2w6dqrokrnxzw"},{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://lists.apache.org/thread.html/zh87okr5qspv4byzfpy2w6dqrokrnxzw"}]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/20/25","tags":[],"source":"mitre","sourceId":"CVE","modified":"2026-10-20T18:10:09.969Z","origins":[{"source":"mitre","sourceId":"CVE","modified":"2026-10-20T18:10:09.969Z","url":"http://www.openwall.com/lists/oss-security/2026/10/20/25"},{"source":"nvd","sourceId":"CVE-2026-93446","modified":"2026-10-20T19:35:38.940","url":"http://www.openwall.com/lists/oss-security/2026/10/20/25"}]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json","tags":["vendor-advisory"],"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json"}]},{"url":"https://access.redhat.com/security/cve/CVE-2026-93446","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://access.redhat.com/security/cve/CVE-2026-93446"}]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2556181","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2556181"}]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-93446","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-93446"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93446","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93446"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:85926","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://access.redhat.com/errata/RHSA-2026:85926"}]},{"url":"https://access.redhat.com/errata/RHSA-2026:81365","tags":["vendor-remediation"],"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://access.redhat.com/errata/RHSA-2026:81365"}]},{"source":"euvd","sourceId":"EUVD-2026-105008","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-105008","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-105008","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-105008"}]}],"packages":[],"pocCandidates":[],"cataloguedPoc":[],"vendorStatements":[{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json","productId":"Red Hat Hardened Images:tomcat10-0:10.1.61-0.1.hum1@noarch@public-hummingbird-aarch64-rpms","product":"tomcat10-0:10.1.61-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:85926"},{"category":"workaround","details":"Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer."}],"purl":"pkg:rpm/redhat/tomcat10@10.1.61-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json"}]},{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json","productId":"Red Hat Hardened Images:tomcat10-admin-webapps-0:10.1.61-0.1.hum1@noarch@public-hummingbird-aarch64-rpms","product":"tomcat10-admin-webapps-0:10.1.61-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:85926"},{"category":"workaround","details":"Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer."}],"purl":"pkg:rpm/redhat/tomcat10-admin-webapps@10.1.61-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json"}]},{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json","productId":"Red Hat Hardened Images:tomcat10-common-0:10.1.61-0.1.hum1@noarch@public-hummingbird-s390x-rpms","product":"tomcat10-common-0:10.1.61-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:85926"},{"category":"workaround","details":"Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer."}],"purl":"pkg:rpm/redhat/tomcat10-common@10.1.61-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json"}]},{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json","productId":"Red Hat Hardened Images:tomcat10-docs-webapp-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms","product":"tomcat10-docs-webapp-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:85926"},{"category":"workaround","details":"Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer."}],"purl":"pkg:rpm/redhat/tomcat10-docs-webapp@10.1.61-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json"}]},{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json","productId":"Red Hat Hardened Images:tomcat10-jsp-3.1-api-0:10.1.61-0.1.hum1@noarch@public-hummingbird-aarch64-rpms","product":"tomcat10-jsp-3.1-api-0:10.1.61-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:85926"},{"category":"workaround","details":"Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer."}],"purl":"pkg:rpm/redhat/tomcat10-jsp-3.1-api@10.1.61-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json"}]},{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json","productId":"Red Hat Hardened Images:tomcat10-lib-0:10.1.61-0.1.hum1@noarch@public-hummingbird-s390x-rpms","product":"tomcat10-lib-0:10.1.61-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:85926"},{"category":"workaround","details":"Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer."}],"purl":"pkg:rpm/redhat/tomcat10-lib@10.1.61-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json"}]},{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json","productId":"Red Hat Hardened Images:tomcat10-servlet-6.0-api-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms","product":"tomcat10-servlet-6.0-api-0:10.1.61-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:85926"},{"category":"workaround","details":"Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer."}],"purl":"pkg:rpm/redhat/tomcat10-servlet-6.0-api@10.1.61-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json"}]},{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json","productId":"Red Hat Hardened Images:tomcat10-webapps-0:10.1.61-0.1.hum1@noarch@public-hummingbird-aarch64-rpms","product":"tomcat10-webapps-0:10.1.61-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:85926"},{"category":"workaround","details":"Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer."}],"purl":"pkg:rpm/redhat/tomcat10-webapps@10.1.61-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json"}]},{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json","productId":"Red Hat Hardened Images:tomcat11-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms","product":"tomcat11-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:81365"},{"category":"workaround","details":"Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer."}],"purl":"pkg:rpm/redhat/tomcat11@11.0.27-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json"}]},{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json","productId":"Red Hat Hardened Images:tomcat11-admin-webapps-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms","product":"tomcat11-admin-webapps-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:81365"},{"category":"workaround","details":"Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer."}],"purl":"pkg:rpm/redhat/tomcat11-admin-webapps@11.0.27-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json"}]},{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json","productId":"Red Hat Hardened Images:tomcat11-docs-webapp-0:11.0.27-0.1.hum1@noarch@public-hummingbird-aarch64-rpms","product":"tomcat11-docs-webapp-0:11.0.27-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:81365"},{"category":"workaround","details":"Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer."}],"purl":"pkg:rpm/redhat/tomcat11-docs-webapp@11.0.27-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json"}]},{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json","productId":"Red Hat Hardened Images:tomcat11-el-6.0-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-s390x-rpms","product":"tomcat11-el-6.0-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:81365"},{"category":"workaround","details":"Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer."}],"purl":"pkg:rpm/redhat/tomcat11-el-6.0-api@11.0.27-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json"}]},{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json","productId":"Red Hat Hardened Images:tomcat11-jsp-4.0-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms","product":"tomcat11-jsp-4.0-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:81365"},{"category":"workaround","details":"Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer."}],"purl":"pkg:rpm/redhat/tomcat11-jsp-4.0-api@11.0.27-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json"}]},{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json","productId":"Red Hat Hardened Images:tomcat11-servlet-6.1-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-aarch64-rpms","product":"tomcat11-servlet-6.1-api-0:11.0.27-0.1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:81365"},{"category":"workaround","details":"Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer."}],"purl":"pkg:rpm/redhat/tomcat11-servlet-6.1-api@11.0.27-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json"}]},{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json","productId":"Red Hat Hardened Images:tomcat11-user-instance-0:11.0.27-0.1.hum1@noarch@public-hummingbird-s390x-rpms","product":"tomcat11-user-instance-0:11.0.27-0.1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:81365"},{"category":"workaround","details":"Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer."}],"purl":"pkg:rpm/redhat/tomcat11-user-instance@11.0.27-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json"}]},{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json","productId":"Red Hat Hardened Images:tomcat11-webapps-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms","product":"tomcat11-webapps-0:11.0.27-0.1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images","status":"fixed","remediations":[{"category":"vendor_fix","details":"For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/","url":"https://access.redhat.com/errata/RHSA-2026:81365"},{"category":"workaround","details":"Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer."}],"purl":"pkg:rpm/redhat/tomcat11-webapps@11.0.27-0.1.hum1?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms","origins":[{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json"}]},{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json","productId":"red_hat_enterprise_linux_10:tomcat","product":"tomcat as a component of Red Hat Enterprise Linux 10","status":"known_affected","remediations":[{"category":"workaround","details":"Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/tomcat","origins":[{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json"}]},{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json","productId":"red_hat_enterprise_linux_10:tomcat-servlet-6.0-api","product":"tomcat-servlet-6.0-api as a component of Red Hat Enterprise Linux 10","status":"known_affected","remediations":[{"category":"workaround","details":"Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/tomcat-servlet-6.0-api","origins":[{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json"}]},{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json","productId":"red_hat_enterprise_linux_10:tomcat9-jsp-2.3-api","product":"tomcat9-jsp-2.3-api as a component of Red Hat Enterprise Linux 10","status":"known_affected","remediations":[{"category":"workaround","details":"Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/tomcat9-jsp-2.3-api","origins":[{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json"}]},{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json","productId":"red_hat_enterprise_linux_6:tomcat6-admin-webapps","product":"tomcat6-admin-webapps as a component of Red Hat Enterprise Linux 6","status":"known_affected","remediations":[{"category":"workaround","details":"Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/tomcat6-admin-webapps","origins":[{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json"}]},{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json","productId":"red_hat_enterprise_linux_6:tomcat6-log4j","product":"tomcat6-log4j as a component of Red Hat Enterprise Linux 6","status":"known_affected","remediations":[{"category":"workaround","details":"Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/tomcat6-log4j","origins":[{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json"}]},{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json","productId":"red_hat_enterprise_linux_7:tomcat-el-2.2-api","product":"tomcat-el-2.2-api as a component of Red Hat Enterprise Linux 7","status":"known_affected","remediations":[{"category":"workaround","details":"Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/tomcat-el-2.2-api","origins":[{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json"}]},{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json","productId":"red_hat_enterprise_linux_7:tomcat-webapps","product":"tomcat-webapps as a component of Red Hat Enterprise Linux 7","status":"known_affected","remediations":[{"category":"workaround","details":"Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/tomcat-webapps","origins":[{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json"}]},{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json","productId":"red_hat_enterprise_linux_8:tomcat-admin-webapps","product":"tomcat-admin-webapps as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/tomcat-admin-webapps","origins":[{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json"}]},{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json","productId":"red_hat_enterprise_linux_8:tomcat.src","product":"tomcat.src as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/tomcat?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json"}]},{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json","productId":"red_hat_enterprise_linux_9:tomcat-docs-webapp","product":"tomcat-docs-webapp as a component of Red Hat Enterprise Linux 9","status":"known_affected","remediations":[{"category":"workaround","details":"Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/tomcat-docs-webapp","origins":[{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json"}]},{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json","productId":"red_hat_jboss_web_server_5:jws5-tomcat","product":"jws5-tomcat as a component of Red Hat JBoss Web Server 5","status":"known_affected","remediations":[{"category":"workaround","details":"Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/jws5-tomcat","origins":[{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json"}]},{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json","productId":"red_hat_jboss_web_server_5:jws5-tomcat-javadoc","product":"jws5-tomcat-javadoc as a component of Red Hat JBoss Web Server 5","status":"known_affected","remediations":[{"category":"workaround","details":"Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/jws5-tomcat-javadoc","origins":[{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json"}]},{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json","productId":"red_hat_jboss_web_server_5:jws5-tomcat-webapps","product":"jws5-tomcat-webapps as a component of Red Hat JBoss Web Server 5","status":"known_affected","remediations":[{"category":"workaround","details":"Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/jws5-tomcat-webapps","origins":[{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json"}]},{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json","productId":"red_hat_jboss_web_server_6:jws6-tomcat-jsp-3.1-api","product":"jws6-tomcat-jsp-3.1-api as a component of Red Hat JBoss Web Server 6","status":"known_affected","remediations":[{"category":"workaround","details":"Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/jws6-tomcat-jsp-3.1-api","origins":[{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json"}]},{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json","productId":"red_hat_jboss_web_server_7:jws7-tomcat.src","product":"jws7-tomcat.src as a component of Red Hat JBoss Web Server 7","status":"known_affected","remediations":[{"category":"workaround","details":"Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/jws7-tomcat?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json"}]},{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json","productId":"red_hat_hardened_images:hi/tomcat","product":"hi/tomcat as a component of Red Hat Hardened Images","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/tomcat?repository_url=registry.redhat.io/hi/tomcat","origins":[{"source":"redhat","sourceId":"CVE-2026-93446","modified":"2026-10-22T21:10:56+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json"}]}],"vendorCoverage":{"total":153,"shown":32,"omitted":121,"source":"redhat"}}