CVE-2026-29146

Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default

HIGH

7.5

CVSS Score

Published: April 9, 2026 at 07:21 PM UTC

Updated: October 26, 2026 at 10:10 PM UTC

3 products affected across 2 vendorsTomcatEnterprise LinuxJBoss Web Server

Using Apache Tomcat by Apache Software Foundation?

Get instant alerts when new vulnerabilities affect Apache Tomcat - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.5

Exploit prediction

EPSS 9%

SSVC

No known exploit

Description

Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Tomcat · Apache

95%

10.0.0 ≤ v < 10.1.5311.0.0 ≤ v < 11.0.207.0.100 ≤ v ≤ 7.0.1098.5.38 ≤ v ≤ 8.5.1009.0.13 ≤ v < 9.0.11610.0.0-M1 11.0.0-M1 7.0.100 8.5.38 9.0.13

Affected range stops below 10.1.53, so it looks safe — our inference, not a vendor statement

Affected range stops below 11.0.20, so it looks safe — our inference, not a vendor statement

Affected range stops below 9.0.116, so it looks safe — our inference, not a vendor statement

Enterprise Linux · Red Hatrpm

60%

Vendor states this is fixed in 0:7.0.76-18.el7_9 (unaffected)

Vendor states this is fixed in 1:10.1.36-2.el10_0 (unaffected)

Vendor states this is fixed in 1:10.1.49-3.el10_2 (unaffected)

Vendor states this is fixed in 1:9.0.117-2.el10_2 (unaffected)

Vendor states this is fixed in 1:9.0.117-2.el9_8 (unaffected)

Vendor states this is fixed in 1:9.0.87-2.el8_10 (unaffected)

Vendor states this is fixed in 1:9.0.87-2.el8_8 (unaffected)

Vendor states this is fixed in 1:9.0.87-2.el9_2 (unaffected)

Vendor states this is fixed in 1:9.0.87-2.el9_4 (unaffected)

Vendor states this is fixed in 1:9.0.87-4.el9_6 (unaffected)

Vendor states this is fixed in 1:9.0.87-6.el10_0 (unaffected)

Vendor states this is fixed in 9 (unaffected)

Vendor states this is fixed in 6 (unknown)

JBoss Web Server · Red Hat

60%

Vendor states this is fixed in 0:10.1.49-13.redhat_00011.1.el10jws (unaffected)

Vendor states this is fixed in 0:10.1.49-13.redhat_00011.1.el8jws (unaffected)

Vendor states this is fixed in 0:10.1.49-13.redhat_00011.1.el9jws (unaffected)

Vendor states this is fixed in 0:11.0.21-5.redhat_00004.1.el10jws (unaffected)

Vendor states this is fixed in 0:11.0.21-5.redhat_00004.1.el8jws (unaffected)

Vendor states this is fixed in 0:11.0.21-5.redhat_00004.1.el9jws (unaffected)

Vendor states this is fixed in 6.2.3 (unaffected)

Vendor states this is fixed in 7.0.0 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://lists.apache.org/thread/lzt04z2pb3dc5tk85obn80xygw3z1p0w

References (20)

Vendor AdvisoryMailing List

Source: cverecord

https://lists.apache.org/thread/lzt04z2pb3dc5tk85obn80xygw3z1p0w

Mailing ListThird Party Advisory

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2026/04/09/24