Loading vulnerability…
Incomplete Cleanup in Apache Tomcat TLS 1.3 Connection Handling
CVE-2026-93446 is a low-severity incomplete cleanup vulnerability in Apache Tomcat that can cause TLS 1.3 connections to fail intermittently. It affects versions 11.0.0-M21 through 11.0.26, 10.1.25 through 10.1.60, and 9.0.90 through 9.0.122. The specific vulnerable function and cleanup sequence have not been identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Intermittent TLS 1.3 connection failures can reduce service availability and disrupt client access to applications served by affected Tomcat instances. No confidentiality or integrity impact is established for this vulnerability.
Patch, then assume compromise.
Upgrade Apache Tomcat to version 11.0.27, 10.1.61, or 9.0.123, or a later fixed release within the corresponding branch.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.