CVE-2026-29129
High · 7.5CVSS
7.5
EPSS
0.4%
Published
Apr 9, 2026
CISA due date
—
The record
Configured cipher preference order not preserved vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.0.115. Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | tomcat | 0 | 9.0.117-160000.1.1 |
| openSUSE:Leap 16.0 | tomcat10 | 0 | 10.1.54-160000.1.1 |
| openSUSE:Leap 16.0 | tomcat11 | 0 | 11.0.21-160000.1.1 |
| openSUSE:Tumbleweed | tomcat | 0 | 9.0.117-1.1 |
| openSUSE:Tumbleweed | tomcat10 | 0 | 10.1.54-1.1 |
| openSUSE:Tumbleweed | tomcat11 | 0 | 11.0.21-1.1 |
Related vulnerabilities
- CVE-2026-43514 Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat. Also affects tomcat
- CVE-2026-43515 Improper Authorization vulnerability when multiple method constraints define an HTTP… Also affects tomcat
- CVE-2026-43513 Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. Also affects tomcat
- CVE-2026-41293 Improper Input Validation vulnerability in Apache Tomcat. Also affects tomcat
- CVE-2026-42498 Exposure of HTTP Authentication Header to unexpected hosts during WebSocket… Also affects tomcat
- CVE-2026-43512 DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache… Also affects tomcat
- CVE-2026-41284 Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. Also affects tomcat
- CVE-2026-34487 Insertion of Sensitive Information into Log File vulnerability in the cloud membership… Also affects tomcat