CVE-2026-29129

Apache Tomcat: TLS cipher order is not preserved

High · published April 9, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
29.5
In the wild
Unconfirmed
What it is

Configured cipher preference order not preserved vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00368 · 29.5th percentile
Published
2026-04-09T19:19Z
EPSS history
Timeline
  • 09 APR 19:19Z
    Apache Tomcat: TLS cipher order is not preserved
    cvelistv5