Apache Tomcat TLS 1.3 failures affect versions 9 through 11

Apache Tomcat has released an advisory addressing an incomplete cleanup vulnerability that could cause intermittent TLS 1.3 connection failures. The issue, tracked as CVE-2026-93446, affects multiple supported branches of the web server software.

What happened

Mark Thomas posted the advisory on the oss-security mailing list on Oct 20. The report details an incomplete cleanup vulnerability within Apache Tomcat that could lead to intermittent failures in TLS 1.3 connections. The flaw is present in Apache Tomcat 11.0.0-M21 through 11.0.26, 10.1.25 through 10.1.60, and 9.0.90 through 9.0.122.

The advisory assigns a low severity rating to the issue. According to the oss-security post, the primary impact is the potential for intermittent failure of secure connections rather than data exposure or remote code execution. Users running the affected versions are recommended to upgrade their installations to resolve the problem.

Why it matters

TLS 1.3 is the latest version of the Transport Layer Security protocol, widely used to secure web traffic. Intermittent connection failures can disrupt service availability and user experience, particularly for applications relying on stable secure connections. While the severity is low, the potential for service disruption makes it a priority for teams managing critical web infrastructure.

The vulnerability affects a broad range of currently supported Tomcat versions. This includes the latest 11.x branch, the 10.1 branch, and the 9.0 branch. Organizations using any of these version ranges need to verify their current status and plan for updates accordingly.

What to watch

• Monitor application logs for TLS 1.3 handshake failures or connection timeouts.
• Check vendor announcements for specific patched version numbers for each affected branch.
• Review SSL/TLS configuration to ensure fallback options are properly managed during updates.
• Track community discussions on oss-security for additional details or workarounds.

Who needs to act first

Teams should prioritize systems exposed to the internet or handling sensitive data. Begin by identifying all servers running the affected Tomcat versions. Test updates in a non-production environment before rolling them out widely. Ensure backups are current before applying any changes. If immediate patching is not possible, consider monitoring for connection failures and preparing a rollback plan.

What to do and how to stay safe: Apache Tomcat

• Inventory all Apache Tomcat instances to identify affected versions 9.0.90-9.0.122, 10.1.25-10.1.60, and 11.0.0-M21-11.0.26.
• Verify TLS 1.3 connectivity to detect intermittent failures before they impact users.
• Prepare to upgrade to the next available version once specific patch details are confirmed.
• Document current configurations to facilitate quick restoration if updates cause issues.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Apache Tomcat versions are affected by CVE-2026-93446?

The vulnerability affects Apache Tomcat 11.0.0-M21 through 11.0.26, 10.1.25 through 10.1.60, and 9.0.90 through 9.0.122.

What is the severity of this vulnerability?

The advisory rates the severity of CVE-2026-93446 as low.

Is there a specific fix version mentioned?

The source material recommends upgrading but does not specify the exact version numbers for the patches.