BIT-tomcat-2026-93446: Apache Tomcat: Possible TLS 1.3 connection failures
Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently.
This issue affects Apache Tomcat: from 11.0.0 through 11.0.26, from 10.1.25 through 10.1.60, from 9.0.90 through 9.0.122.
Users are recommended to upgrade to version 11.0.27, 10.1.61 or 9.0.123, which fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bitnami/tomcatto a version that resolves this vulnerability.Fixed in 9.0.123 - Upgrade
Upgrade
bitnami/tomcatto a version that resolves this vulnerability.Fixed in 10.1.61 - Upgrade
Upgrade
bitnami/tomcatto a version that resolves this vulnerability.Fixed in 11.0.27 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 11.0.27 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 10.1.61 - Upgrade
Upgrade
Apache Tomcatto a version that resolves this vulnerability.Fixed in 9.0.123
Event History
Frequently Asked Questions
Which Tomcat versions need to be upgraded?
Affected release ranges are 11.0.0 through 11.0.26, 10.1.25 through 10.1.60, and 9.0.90 through 9.0.122. Upgrade to 11.0.27, 10.1.61, or 9.0.123 respectively.
What is the observable impact of this issue?
TLS 1.3 connections can fail intermittently because of incomplete cleanup. The provided information does not describe impacts on TLS versions other than TLS 1.3.