Skip to content
VulniPulse
Sign in
Highest advisory severityMedium 2 vendors · 2 advisories

CVE-2026-93446

Possible TLS 1.3 connection failures

CVE-2026-93446: Possible TLS 1.3 connection failures. Not in the CISA KEV catalog. Medium advisory severity. Fixed in 11.0.27, 10.1.61 (Apache).

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

CVE-2026-93446 at a glance

CISA KEV
Not listed (catalog checked )
Highest advisory severity
Medium
Weakness
CWE-459
Fixed releases
  • Apache: 11.0.27, 10.1.61, 9.0.123
  • Red Hat: tomcat10-main-10.1.61-0.1.hum1, tomcat11-main-11.0.27-0.1.hum1, RHSA-2026:85926
Vendor advisories
2 from Apache, Red Hat
VulniPulse record
Published · Updated

Scores, vectors, weaknesses and fixed releases are quoted from vendor advisories that cover only CVE-2026-93446; bulletin-wide values are not repeated here.

Is CVE-2026-93446 exploited?

No exploitation is reported in the sources VulniPulse tracks: CVE-2026-93446 is not in the CISA KEV catalog (checked ) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.

How do I fix CVE-2026-93446?

Upgrade to a fixed release named by the vendor:

  • Apache: 11.0.27, 10.1.61, 9.0.123
  • Red Hat: tomcat10-main-10.1.61-0.1.hum1, tomcat11-main-11.0.27-0.1.hum1, RHSA-2026:85926
  • Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue. (Apache)

Vendor advisory comparison

Apache

1 advisory
  • Advisory severityUnrated

    Advisory [CVE-2026-93446] Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently

    CVE-2026-93446Source published Source updated

    Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently. This issue affects Apache Tomcat: from 11.0.0-M21 through 11.0.26, from 10.1.25 through 10.1.60, from 9.0.90 through 9.0.122. Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.

    Affected products in this advisory
    • Apache Tomcat
    Source-reported affected versions
    • 11.0.0-M21 through 11.0.26
    • 10.1.25 through 10.1.60
    • 9.0.90 through 9.0.122.
    • through 9.0.122
    Source-reported fixed versions
    • 11.0.27
    • 10.1.61
    • 9.0.123
    Mitigation guidance
    • Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.
    Full advisory and evidenceOpen source bulletin

Red Hat

1 advisory
  • Advisory severityMedium

    Medium [CVE-2026-93446] Possible TLS 1.3 connection failures

    CVE-2026-93446Source published Source updated

    Possible TLS 1.3 connection failures. Red Hat rates this moderate. Weakness: CWE-459. Red Hat lists fixing advisory RHSA-2026:85926 with package tomcat10-main-10.1.61-0.1.hum1, tomcat11-main-11.0.27-0.1.hum1. Affected product named by the advisory: Red Hat Hardened Images.

    Related products — impact not confirmed
    • Red Hat Hardened Images
    Source-reported affected versions
    Affected-version details not available in this record.
    Source-reported fixed versions
    • tomcat10-main-10.1.61-0.1.hum1
    • tomcat11-main-11.0.27-0.1.hum1
    • RHSA-2026:85926
    Mitigation guidance
    No mitigation guidance extracted; consult the source.
    Full advisory and evidenceOpen source bulletin

Browse the latest tracked CVEs or the CVEs listed in CISA KEV.

Android app · Google Play

Turn CVE research into alerts on your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features