CVE-2026-93446

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-93446", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-09-17T22:18:31.729Z", "datePublished": "2026-10-20T13:44:35.673Z", "dateUpdated": "2026-10-29T17:57:06.247Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-10-20T13:44:35.673Z"}, "title": "Apache Tomcat: Possible TLS 1.3 connection failures", "problemTypes": [{"descriptions": [{"description": "CWE-459 Incomplete cleanup", "lang": "en", "cweId": "CWE-459", "type": "CWE"}]}], "source": {"discovery": "EXTERNAL"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Tomcat", "versions": [{"status": "affected", "version": "11.0.0-M21", "lessThanOrEqual": "11.0.26", "versionType": "semver"}, {"status": "affected", "version": "10.1.25", "lessThanOrEqual": "10.1.60", "versionType": "semver"}, {"status": "affected", "version": "9.0.90", "lessThanOrEqual": "9.0.122", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"value": "Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M21 through 11.0.26, from 10.1.25 through 10.1.60, from 9.0.90 through 9.0.122.\n\n\n\nUsers are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently.</p><p>This issue affects Apache Tomcat: from 11.0.0-M21 through 11.0.26, from 10.1.25 through 10.1.60, from 9.0.90 through 9.0.122.</p><p>Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.</p>"}]}], "references": [{"url": "https://lists.apache.org/thread.html/zh87okr5qspv4byzfpy2w6dqrokrnxzw", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "low"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "FHMTT (https://github.com/FHMTT)", "type": "finder"}], "x_generator": {"engine": "Vulnogram 1.0.3"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/10/20/25"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-20T18:10:09.969Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-10-29T17:56:57.205909Z", "id": "CVE-2026-93446", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T17:57:06.247Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/10/20/25"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-20T18:10:09.969Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-93446", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-29T17:56:57.205909Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-29T17:56:34.357Z"}}], "cna": {"title": "Apache Tomcat: Possible TLS 1.3 connection failures", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "FHMTT (https://github.com/FHMTT)"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "low"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Tomcat", "versions": [{"status": "affected", "version": "11.0.0-M21", "versionType": "semver", "lessThanOrEqual": "11.0.26"}, {"status": "affected", "version": "10.1.25", "versionType": "semver", "lessThanOrEqual": "10.1.60"}, {"status": "affected", "version": "9.0.90", "versionType": "semver", "lessThanOrEqual": "9.0.122"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread.html/zh87okr5qspv4byzfpy2w6dqrokrnxzw", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.3"}, "descriptions": [{"lang": "en", "value": "Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M21 through 11.0.26, from 10.1.25 through 10.1.60, from 9.0.90 through 9.0.122.\n\n\n\nUsers are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.", "supportingMedia": [{"type": "text/html", "value": "<p>Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently.</p><p>This issue affects Apache Tomcat: from 11.0.0-M21 through 11.0.26, from 10.1.25 through 10.1.60, from 9.0.90 through 9.0.122.</p><p>Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-459", "description": "CWE-459 Incomplete cleanup"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-10-20T13:44:35.673Z"}}}, "cveMetadata": {"cveId": "CVE-2026-93446", "state": "PUBLISHED", "dateUpdated": "2026-10-29T17:57:06.247Z", "dateReserved": "2026-09-17T22:18:31.729Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-10-20T13:44:35.673Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Apache Tomcat", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "11.0.26", "status": "affected", "version": "11.0.0-M21", "versionType": "semver"}, {"lessThanOrEqual": "10.1.60", "status": "affected", "version": "10.1.25", "versionType": "semver"}, {"lessThanOrEqual": "9.0.122", "status": "affected", "version": "9.0.90", "versionType": "semver"}]}], "source": "security@apache.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M21 through 11.0.26, from 10.1.25 through 10.1.60, from 9.0.90 through 9.0.122.\n\n\n\nUsers are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue."}], "id": "CVE-2026-93446", "lastModified": "2026-10-29T18:17:39.557", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-93446", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-29T17:56:57.205909Z", "version": "2.0.3"}}]}, "published": "2026-10-20T14:17:04.473", "references": [{"source": "security@apache.org", "url": "https://lists.apache.org/thread.html/zh87okr5qspv4byzfpy2w6dqrokrnxzw"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/10/20/25"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-459"}], "source": "security@apache.org", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2026:81365", "cpe": "cpe:/a:redhat:hummingbird:1", "package": "tomcat11-main-11.0.27-0.1.hum1", "product_name": "Red Hat Hardened Images", "release_date": "2026-10-12T00:00:00Z"}, {"advisory": "RHSA-2026:85926", "cpe": "cpe:/a:redhat:hummingbird:1", "package": "tomcat10-main-10.1.61-0.1.hum1", "product_name": "Red Hat Hardened Images", "release_date": "2026-10-20T00:00:00Z"}], "bugzilla": {"description": "tomcat: Apache Tomcat: Possible TLS 1.3 connection failures", "id": "2556181", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556181"}, "csaw": false, "cwe": "CWE-459", "details": ["A flaw was found in Apache Tomcat. An incomplete cleanup vulnerability can cause Transport Layer Security (TLS) 1.3 connections to fail intermittently. This issue may prevent remote clients from establishing secure connections, resulting in an intermittent Denial of Service (DoS)."], "name": "CVE-2026-93446", "public_date": "2026-10-20T13:44:35Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-93446\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-93446\nhttps://lists.apache.org/thread.html/zh87okr5qspv4byzfpy2w6dqrokrnxzw"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[11.0.0-M21,11.0.26]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[10.1.25,10.1.60]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.0.90,9.0.122]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache Tomcat", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "apache_tomcat", "vendor": "apache"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[11.0.0-M21,11.0.26]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[10.1.25,10.1.60]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.0.90,9.0.122]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache Tomcat", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "tomcat", "vendor": "apache"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[11.0.0-M21,11.0.26]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[10.1.25,10.1.60]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.0.90,9.0.122]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache Tomcat", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "tomcat", "vendor": "apache_software_foundation"}], "created": "2026-10-20T16:15:14.273626+00:00", "updated": "2026-10-29T22:15:04.258916+00:00", "vendors": ["apache", "apache$PRODUCT$apache_tomcat", "apache$PRODUCT$tomcat", "apache_software_foundation", "apache_software_foundation$PRODUCT$tomcat"]}