The vulnerability arises from incomplete resource cleanup in Apache Tomcat, which can cause TLS 1.3 connections to fail intermittently. This results in a denial of service for clients attempting secure communication, potentially disrupting application availability. The weakness is classified as CWE-459, indicating a flaw in cleanup or resource deallocation.

The issue affects Apache Tomcat versions from 11.0.0-M21 through 11.0.26, from 10.1.25 through 10.1.60, and from 9.0.90 through 9.0.122. All deployments of these versions that accept TLS 1.3 traffic are subject to the failure behavior.

The CVSS score of 7.5 indicates high severity, while the EPSS score of < 1% and the lack of listing in CISA KEV suggest a low probability of widespread exploitation at present. The problem manifests only when a TLS 1.3 session is established, and no weaponized exploit is documented. Therefore, the risk level is primarily concerning availability rather than confidentiality or integrity, with a modest likelihood of operational impact.