CVE-2026-93446

A flaw was found in Apache Tomcat. An incomplete cleanup vulnerability can cause Transport Layer Security (TLS) 1.3 connections to fail intermittently. This issue may prevent remote clients from establishing secure connections, resulting in an intermittent Denial of Service (DoS).

A flaw was found in Apache Tomcat. Due to an incomplete cleanup vulnerability during TLS 1.3 connection termination or state recycling, subsequent attempts by remote clients to establish a TLS 1.3 handshake can fail intermittently. An unauthenticated remote attacker can exploit this condition by initiating network connections over TLS 1.3, resulting in an intermittent denial of service where valid clients are unable to establish secure communication sessions with the Tomcat server, operating within the boundaries of the host process environment.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Configure Tomcat's SSLHostConfig or connector configuration in server.xml to temporarily disable TLS 1.3 by restricting sslProtocols to TLSv1.2, or terminate TLS 1.3 connections at an upstream reverse proxy or load balancer.