CVE-2026-93446

Public on 2026-10-20
Modified on 2026-10-22
Description
Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently.



This issue affects Apache Tomcat: from 11.0.0-M21 through 11.0.26, from 10.1.25 through 10.1.60, from 9.0.90 through 9.0.122.



Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.
Severity
Low severity
Low
See what this means
CVSS v3 Base Score
3.7
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 2 - Tomcat9 Extra tomcat Pending Fix
Amazon Linux 2 - Core tomcat Not Affected
Amazon Linux 2 - Core tomcat-native Not Affected
Amazon Linux 2023 tomcat-native Not Affected
Amazon Linux 2027 Preview tomcat-native Not Affected
Amazon Linux 2023 tomcat10 Pending Fix
Amazon Linux 2027 Preview tomcat10 Pending Fix
Amazon Linux 2023 tomcat11 Pending Fix
Amazon Linux 2023 tomcat9 Pending Fix
Amazon Linux 2027 Preview tomcat9 Pending Fix
Amazon Linux 2 - Core tomcatjss Not Affected

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

References

FAQs regarding Amazon Linux ALAS/CVE Severity Red Hat: CVE-2026-93446 Mitre: CVE-2026-93446