{"id":"CVE-2026-93446","aliases":[],"cve":{"records":[{"id":"CVE-2026-93446","source":"apache","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-17T22:18:31.729Z","published":"2026-10-20T13:44:35.673Z","modified":"2026-10-29T17:57:06.247Z"}],"publishers":[{"name":"apache","role":"CNA","organizationId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","modified":"2026-10-20T13:44:35.673Z"},{"name":"CVE","role":"ADP","organizationId":"af854a3a-2127-422b-91ae-364da2661108","modified":"2026-10-20T18:10:09.969Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-29T17:57:06.247Z"}],"references":[{"url":"https://lists.apache.org/thread.html/zh87okr5qspv4byzfpy2w6dqrokrnxzw","tags":["vendor-advisory"],"source":"apache"},{"url":"http://www.openwall.com/lists/oss-security/2026/10/20/25","tags":[],"source":"CVE"}],"weaknesses":[{"id":"CWE-459","description":"CWE-459 Incomplete cleanup","source":"apache"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-29T17:56:57.205909Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Apache Tomcat: Possible TLS 1.3 connection failures","titleSource":"apache","descriptionSource":"apache","description":"Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M21 through 11.0.26, from 10.1.25 through 10.1.60, from 9.0.90 through 9.0.122.\n\n\n\nUsers are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.","score":7.5,"severity":"high","published":"2026-10-20T13:44:35.673Z","modified":"2026-10-29T17:57:06.247Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Apache Software Foundation","name":"Apache Tomcat","platforms":[],"versions":[{"version":"11.0.0-M21","status":"affected","lessThanOrEqual":"11.0.26","versionType":"semver"},{"version":"10.1.25","status":"affected","lessThanOrEqual":"10.1.60","versionType":"semver"},{"version":"9.0.90","status":"affected","lessThanOrEqual":"9.0.122","versionType":"semver"}],"defaultStatus":"unaffected","cpes":[],"source":"apache","url":"https://www.cve.org/CVERecord?id=CVE-2026-93446"}],"remediation":[],"references":["https://lists.apache.org/thread.html/zh87okr5qspv4byzfpy2w6dqrokrnxzw","http://www.openwall.com/lists/oss-security/2026/10/20/25"],"sources":[{"name":"CVE","id":"CVE-2026-93446","modified":"2026-10-29T17:57:06.247Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-93446"}],"assessments":[{"source":"CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5}],"sourceAffected":[],"observedAt":"2026-10-29T18:10:50.389Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:25:31.038Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-29T18:15:33.016Z","attemptedAt":"2026-10-29T18:15:33.016Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-29T18:15:33.171Z","attemptedAt":"2026-10-29T18:15:33.171Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-29T18:15:34.051Z","attemptedAt":"2026-10-29T18:15:34.051Z"},{"source":"EPSS","status":"available","checkedAt":"2026-10-29T18:15:33.034Z","attemptedAt":"2026-10-29T18:15:33.034Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-93446","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93446","modified":"2026-10-20T19:35:38.940","checkedAt":"2026-10-29T18:15:33.016Z"},{"source":"FIRST EPSS","id":"CVE-2026-93446","url":"https://www.first.org/epss/","probability":0.0025,"percentile":0.16395,"date":"2026-10-29","checkedAt":"2026-10-29T18:15:33.034Z"},{"source":"GitHub Advisory Database","id":"GHSA-2w6h-6wr9-m5r8","url":"https://github.com/advisories/GHSA-2w6h-6wr9-m5r8","modified":"2026-10-20T21:31:58Z","checkedAt":"2026-10-29T18:15:33.171Z"},{"source":"ENISA EUVD","id":"EUVD-2026-105008","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-105008","modified":"Oct 20, 2026, 6:10:09 PM","checkedAt":"2026-10-29T18:15:34.051Z"}],"aiSummary":{"text":"Apache Tomcat versions 11.0.0-M21 through 11.0.26, 10.1.25 through 10.1.60, and 9.0.90 through 9.0.122 have an incomplete cleanup vulnerability that may cause intermittent TLS 1.3 connection failures. The issue can be addressed by upgrading to version 11.0.27, 10.1.61, or 9.0.123. No specific attacker access is mentioned.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:53:49.703Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-93446"}]}}