{"id":"CVE-2026-93446","title":"tomcat: Apache Tomcat: Possible TLS 1.3 connection failures (CVE-2026-93446)","summary":"A flaw was found in Apache Tomcat. An incomplete cleanup vulnerability can cause Transport Layer Security (TLS) 1.3 connections to fail intermittently. This issue may prevent remote clients from establishing secure connections, resulting i…","severity":"medium","cwe":"CWE-459","vendor":"Red Hat","product":"Red Hat Hardened Images","affected":["hardened_images"],"patched":["hardened_images"],"published":"2026-10-20","updated":"2026-10-20","sourceUpdated":"2026-10-20T23:30:32+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93446.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-93446"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2556181"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-93446"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93446"},{"url":"https://lists.apache.org/thread.html/zh87okr5qspv4byzfpy2w6dqrokrnxzw"},{"url":"https://access.redhat.com/errata/RHSA-2026:85926"},{"url":"https://access.redhat.com/errata/RHSA-2026:81365"}],"tags":["csaf","vex","red-hat","cve.org"],"ingestedAt":"2026-10-20T14:08:00.569Z","epss":0.0025,"epssPercentile":0.16284,"slug":"CVE-2026-93446","body":"## Overview\n\nA flaw was found in Apache Tomcat. An incomplete cleanup vulnerability can cause Transport Layer Security (TLS) 1.3 connections to fail intermittently. This issue may prevent remote clients from establishing secure connections, resulting in an intermittent Denial of Service (DoS).\n\n## Vendor advisories\n\n- **RHSA-2026:85926** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:85926)\n- **RHSA-2026:81365** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-10-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:81365)\n\n**tomcat: Apache Tomcat: Possible TLS 1.3 connection failures** — rated Moderate by Red Hat. Released 2026-10-20.\n\nFixed:\n\n- Red Hat Hardened Images\n\n## Remediation\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:85926\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:81365","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":227166,"id":"CVE-2026-93446","ts":1792585177120,"field":"severity","old":"none","new":"medium"}]}