CYBERSECURITYTRACKER
Permanent story citation

CVE-2026-93446: Apache Tomcat: Possible TLS 1.3 connection failures

This page keeps the story as Cybersecurity Tracker first published it. If the tracker later corrects it, the correction appears below the original and never replaces it.

Back to newsStory 10809

As cited

Copy frozen at (site build).

vulnerabilities

CVE-2026-93446: Apache Tomcat: Possible TLS 1.3 connection failures

Apache Tomcat versions 9.0.90 through 9.0.122, 10.1.25 through 10.1.60, and 11.0.0-M21 through 11.0.26 contain an incomplete cleanup vulnerability that can cause TLS 1.3 connections to fail intermittently. The issue is rated low severity. Users should upgrade to patched versions.

Why it matters: Practitioners running affected Tomcat versions may experience connection failures under TLS 1.3, potentially affecting application availability and requiring urgent patching to maintain reliable encrypted communications.

CVEsCVE-2026-93446
Source published
First seen by Cybersecurity Tracker

Source attribution

Glossary

Open in glossary