CVE-2026-29146
High · 7.5CVSS
7.5
EPSS
2.9%
Published
Apr 9, 2026
CISA due date
—
The record
Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | tomcat | 0 | 9.0.117-160000.1.1 |
| openSUSE:Leap 16.0 | tomcat10 | 0 | 10.1.54-160000.1.1 |
| openSUSE:Leap 16.0 | tomcat11 | 0 | 11.0.21-160000.1.1 |
| openSUSE:Tumbleweed | tomcat | 0 | 9.0.117-1.1 |
| openSUSE:Tumbleweed | tomcat10 | 0 | 10.1.54-1.1 |
| openSUSE:Tumbleweed | tomcat11 | 0 | 11.0.21-1.1 |
Related vulnerabilities
- CVE-2026-43514 Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat. Also affects tomcat
- CVE-2026-43515 Improper Authorization vulnerability when multiple method constraints define an HTTP… Also affects tomcat
- CVE-2026-43513 Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. Also affects tomcat
- CVE-2026-41293 Improper Input Validation vulnerability in Apache Tomcat. Also affects tomcat
- CVE-2026-42498 Exposure of HTTP Authentication Header to unexpected hosts during WebSocket… Also affects tomcat
- CVE-2026-43512 DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache… Also affects tomcat
- CVE-2026-41284 Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. Also affects tomcat
- CVE-2026-34487 Insertion of Sensitive Information into Log File vulnerability in the cloud membership… Also affects tomcat