CVE-2026-29146
Apache Tomcat: padding oracle in the EncryptInterceptor
Technology
Apache Tomcat
CVSS Score
7.5 / 10.0
Affected Versions
11.0.0-M1 to 11.0.18; 10.0.0-M1 to 10.1.52; 9.0.13 to 9.0.115; 8.5.38 to 8.5.100; 7.0.100 to 7.0.109
Upstream Fix
11.0.20; 10.1.53; 9.0.116
Published
April 9, 2026
OSSeva Coverage
Fixed upstream
Description
The cluster EncryptInterceptor was vulnerable to a padding oracle with its default configuration. Fixed in 11.0.20 (the 11.0.19 release vote did not pass), 10.1.53 and 9.0.116. The fix introduced CVE-2026-34486, so those three releases need a further upgrade.
Is your Apache Tomcat deployment affected?
If you're running 11.0.0-M1 to 11.0.18; 10.0.0-M1 to 10.1.52; 9.0.13 to 9.0.115; 8.5.38 to 8.5.100; 7.0.100 to 7.0.109, you need this patch. Book a discovery call to get covered.
Get a quote
Running Apache Tomcat 11.0.0-M1 to 11.0.18; 10.0.0-M1 to 10.1.52; 9.0.13 to 9.0.115; 8.5.38 to 8.5.100; 7.0.100 to 7.0.109?
Send your work email and a senior engineer will tell you whether this CVE applies to your versions and who patches it. Reply within 1 business day.
Prefer to talk or read more first?