CVE-2026-93446Medium▾ SunlitA flaw was found in Apache Tomcat. An incomplete cleanup vulnerability can cause Transport Layer Security (TLS) 1.3 connections to fail intermittently. This issue may prevent remote clients from establishing secure connections, resulting i…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 22.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
none → medium
0.3%
A flaw was found in Apache Tomcat. An incomplete cleanup vulnerability can cause Transport Layer Security (TLS) 1.3 connections to fail intermittently. This issue may prevent remote clients from establishing secure connections, resulting in an intermittent Denial of Service (DoS).
tomcat: Apache Tomcat: Possible TLS 1.3 connection failures — rated Moderate by Red Hat. Released 2026-10-20.
Fixed:
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:85926 For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:81365
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-88041Lowtomcat: tomcat: Information disclosure via incomplete HTTP trailer cleanup (CVE-2026-88041)
CVE-2026-74048Low· 3.7tomcat: Tomcat: Cryptographic policy bypass via FIPS activation failure (CVE-2026-74048)
CVE-2026-74049Low· 3.7tomcat: Apache Tomcat: Jasper JSTL <c:redirect> plug-in implementation omits page abort (SKIP_PAGE) (CVE-2026-74049)
CVE-2026-80353Low· 3.6tomcat: tomcat: Unauthorized socket access via TOCTOU race condition (CVE-2026-80353)
CVE-2026-101356Medium· 5.3tomcat: tomcat: Information disclosure via incorrect object recycling in HTTP/2 processing (CVE-2026-101356)
CVE-2026-103119Medium· 4.8tomcat: Apache Tomcat: Information disclosure via buffer under-read during non-blocking writes (CVE-2026-103119)