Apache Tomcat CVE-2026-93446

EUVD-2026-105008 LOW

Incomplete Cleanup (CWE-459)

2026-10-20 apache

GHSA-2w6h-6wr9-m5r8

Apache Information Disclosure Tomcat Apache Tomcat

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach Tomcat TLS 1.3 listener
Exploit

Repeatedly establish TLS 1.3 connections
Execution

Trigger incomplete cleanup of connection state
Impact

Intermittent connection failures / degraded availability

Vulnerability Assessment

Weakness	CWE CWE-459 ASVS 5.0 V15 - Secure Coding and Architecture Incomplete cleanup
Exploitation Conditions	Requires the affected Tomcat instance to be serving TLS 1.3 connections - the defect is specific to TLS 1.3 session/connection handling (incomplete cleanup, CWE-459). Deployments using only TLS 1.2 or with TLS terminated upstream (e.g., at a reverse proxy/load balancer rather than Tomcat) are not affected. The impact is limited to intermittent connection failures (availability degradation); there is no indicated path to code execution, data disclosure, or persistent compromise, and no special attacker privilege or crafted payload is described - the condition can arise under normal TLS 1.3 traffic.
Impact	This is a low-severity availability/reliability issue, not a high-impact security flaw. The description (CWE-459, Incomplete Cleanup) states the bug 'could cause TLS 1.3 connections to fail intermittently' - this is an availability symptom (dropped/failed connections), with no indication of confidentiality or integrity impact. No CVSS vector, EPSS score, KEV listing, or POC is provided in the input, so there are no signals pointing to active exploitation or weaponization; this reads as a functional defect rather than an attacker-driven primitive. IMPORTANT DATA CONFLICT: the input Tags include 'Information Disclosure,' but the description describes intermittent connection FAILURES (availability), not data leakage - the tag appears mislabeled and should not drive prioritization. With no CVSS vector supplied, authentication requirements cannot be confirmed from CVSS; treat as affecting remote clients establishing TLS 1.3 sessions. Overall: routine-priority patch for most operators; prioritize only where TLS 1.3 connection stability is operationally critical.
Exploit ScenarioDerived	An attacker or even normal client load repeatedly establishes TLS 1.3 connections to an affected Tomcat instance; due to incomplete cleanup of connection/session state, a fraction of handshakes or connections fail intermittently, degrading service reliability. No public exploit identified at time of analysis, and the condition may manifest under normal traffic rather than requiring deliberate attacker action.

Monitor Track and reassess. Why: LOW severity (CVSS 0.1-3.9).

No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 20, 2026

Intermittent TLS 1.3 connection failures in Apache Tomcat (11.0.0-M21 through 11.0.26, 10.1.25 through 10.1.60, and 9.0.90 through 9.0.122) stem from incomplete cleanup of TLS 1.3 connection state, causing availability degradation rather than any loss of confidentiality or integrity. Remote attackers - or simply ordinary TLS 1.3 clients - can trigger the condition under normal traffic; the assessed vector is AV:N/AC:H/PR:N/UI:N with C:N/I:N/A:L, reflecting high attack complexity and only limited availability impact, with no path to code execution or data disclosure. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and vendor-released fixes exist in 11.0.27, 10.1.61, and 9.0.123.

RemediationAI

Vendor-released patch: upgrade to Apache Tomcat 11.0.27, 10.1.61, or 9.0.123 respectively, as directed by the Apache advisory at https://lists.apache.org/thread.html/zh87okr5qspv4byzfpy2w6dqrokrnxzw; no configuration change is required beyond the upgrade. Where an immediate upgrade is not feasible, the defect can be avoided entirely by pinning the affected connector to TLS 1.2 (for example setting sslProtocol/sslEnabledProtocols to TLSv1.2 on the relevant Connector), at the cost of losing TLS 1.3 performance and modern cipher-suite benefits and potentially breaking clients that require TLS 1.3 only. Alternatively, move TLS termination upstream to a reverse proxy or load balancer so Tomcat serves plaintext or TLS 1.2 behind it - this removes exposure but adds architectural complexity and shifts certificate and cipher management to the fronting tier. Neither workaround addresses confidentiality or integrity risk (none is assessed), so they are purely availability stabilizers and should be treated as temporary until the patched release is deployed.

Affected VersionsENISA

Apache Tomcat 10.1.25 ≤10.1.60

Apache Tomcat 9.0.90 ≤9.0.122

Apache Tomcat 11.0.0-M21 ≤11.0.26

Affected Packages

euvd apache_tomcat no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The root cause is CWE-459 (Incomplete Cleanup): Tomcat's TLS 1.3 handling leaves per-connection state uncleaned, so subsequent handshakes or connection teardown can fail intermittently. TLS 1.3 differs materially from TLS 1.2 in session resumption (PSK/session tickets), post-handshake messaging, and 0-RTT data, all of which require endpoint implementations such as Tomcat's JSSE/OpenSSL-backed connectors to track and release state precisely; a cleanup gap in this lifecycle path manifests as intermittent handshake or connection failures rather than a classic memory-safety bug. The vulnerable code lives in the Tomcat HTTP connector/TLS endpoint layer of the Apache Software Foundation product identified by CPE cpe:2.3:a:apache_software_foundation:apache_tomcat, and the defect is scoped strictly to deployments where Tomcat itself terminates TLS 1.3 - installations that terminate TLS at a reverse proxy or load balancer, or that negotiate only TLS 1.2, never reach the faulty path.

Know when Apache Tomcat gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (apache) PRIMARY LOW

vuln.today AI 3.7 LOW

Network-facing TLS listener (AV:N), intermittent/non-deterministic trigger implies AC:H, no auth needed (PR:N); impact is limited availability degradation only, so C:N/I:N/A:L.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

DescriptionCVE.org

Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently.

This issue affects Apache Tomcat: from 11.0.0-M21 through 11.0.26, from 10.1.25 through 10.1.60, from 9.0.90 through 9.0.122.

Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.

Threat Intelligence Overview

EPSS Score

0.3%

Top 83% exploitable

Prevalence

High

widely-deployed enterprise Java application server (Apache Tomcat)

Social Media

Sightings

Data Quality

1 sources

Confidence: Low

EUVD

CVE.org

EPSS CIRCL

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity LOW

CISA KEV No

Public POC No

EPSS 0.3%

Patch available No

Active threat No

Deciding rule

LOW severity (CVSS 0.1-3.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.