Skip to content
Fencer Vulns
high 7.5

CVE-2026-93446 json

Apache Tomcat: Possible TLS 1.3 connection failures

published 2026-10-20 20 d ago modified 2026-10-30 10 d ago also BIT-tomcat-2026-93446 , EUVD-2026-105008

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 48%
public exploits
0
none known

Summary

Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently.

This issue affects Apache Tomcat: from 11.0.0-M21 through 11.0.26, from 10.1.25 through 10.1.60, from 9.0.90 through 9.0.122.

Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.

Patch / fix

  • bitnami tomcat 9.0.123, 10.1.61, 11.0.27
  • tomcat9 Debian 14, Debian 13, Debian 12 9.0.70-2

debian advisories DEBIAN-CVE-2026-93446

  • tomcat SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 9.0.123-150200.126.1
  • tomcat10 SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES 15 SP6-LTSS +4 more 10.1.61-150200.5.85.1
  • tomcat SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 9.0.123-3.182.2
  • libapr1 SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 1.6.5-4.13.1
  • libtcnative-1-0 SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 1.3.9-3.9.1

suse advisories SUSE-SU-2026:5116-1SUSE-SU-2026:5073-1SUSE-SU-2026:4927-1

  • tomcat openSUSE Tumbleweed 9.0.123-1.1
  • tomcat10 openSUSE Tumbleweed 10.1.61-1.1
  • tomcat11 openSUSE Tumbleweed 11.0.27-1.1

opensuse advisories openSUSE-SU-2026:12254-1openSUSE-SU-2026:12255-1openSUSE-SU-2026:12256-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-93446 updated cvss 5.3

tomcat: Apache Tomcat: Possible TLS 1.3 connection failures

  • Red Hat Enterprise Linux 6 tomcat6, tomcat6-lib, tomcat6-log4j, tomcat6-javadoc, tomcat6-webapps, tomcat6-el-2.1-api, +4 more Red Hat Enterprise Linux 7 tomcat, tomcat-lib, tomcat-jsvc, tomcat-javadoc, tomcat-webapps, tomcat-el-2.2-api, +4 more Red Hat Enterprise Linux 8 tomcat, tomcat-lib, tomcat-webapps, tomcat-el-3.0-api, pki-servlet-engine, tomcat-docs-webapp, +4 more Red Hat Enterprise Linux 9 tomcat, tomcat-lib, tomcat-webapps, tomcat-el-3.0-api, pki-servlet-engine, tomcat-docs-webapp, +4 more Red Hat Enterprise Linux 10 tomcat, tomcat9 Red Hat JBoss Web Server 5 jws5-tomcat, jws5-tomcat-lib, jws5-tomcat-jsvc, jws5-tomcat-javadoc, jws5-tomcat-selinux, jws5-tomcat-webapps, +7 more
    +2 more products
    Red Hat JBoss Web Server 6 jws6-tomcat, jws6-tomcat-lib, jws6-tomcat-javadoc, jws6-tomcat-selinux, jws6-tomcat-webapps, jws6-tomcat-el-5.0-api, +4 more Red Hat JBoss Web Server 7 jws7-tomcat
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Hardened Images tomcat10 10.1.61-0.1.hum1, tomcat11 11.0.27-0.1.hum1, tomcat10-lib 10.1.61-0.1.hum1, tomcat11-lib 11.0.27-0.1.hum1, tomcat10-common 10.1.61-0.1.hum1, tomcat11-common 11.0.27-0.1.hum1, +14 more
    fixed: vendor fix RHSA-2026:85926
  • Red Hat Hardened Images hi/tomcat
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
10 d ago

Exploit prediction

0.59% chance of exploitation in the next 30 days, higher than 48% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
bitnami tomcat
>=9.0.90, <9.0.123
>=10.1.25, <10.1.61
>=11.0.0, <11.0.27
9.0.123
10.1.61
11.0.27

Affected products

  • Apache Software Foundation Apache Tomcat

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.