CVE-2026-29146CWE-1240CWE-209CWE-642

CVE-2026-29146

High · published April 10, 2026

CVSS v3.1
7.5
EPSS
9%
Percentile
94.9
In the wild
Unconfirmed
What it is

Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.

Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.08850 · 94.9th percentile
Weaknesses
CWE-1240 · Use of a Cryptographic Primitive with a Risky Implementation; CWE-209 · Generation of Error Message Containing Sensitive Information; CWE-642 · External Control of Critical State Data
Published
2026-04-10T00:16Z
Affected products (5)
ProductVersionsFixed in
apache/tomcat≥ 7.0.100, ≤ 7.0.109
apache/tomcat≥ 8.5.38, ≤ 8.5.100
apache/tomcat≥ 9.0.13, < 9.0.1169.0.116
apache/tomcat≥ 10.0.0, < 10.1.5310.1.53
apache/tomcat≥ 11.0.0, < 11.0.2011.0.20
References (20)
https://lists.apache.org/thread/lzt04z2pb3dc5tk85obn80xygw3z1p0w · [email protected]http://www.openwall.com/lists/oss-security/2026/04/09/24 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2026:20405 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/errata/RHSA-2026:20406 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/errata/RHSA-2026:36787 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/errata/RHSA-2026:36788 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/errata/RHSA-2026:36789 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/errata/RHSA-2026:36790 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/errata/RHSA-2026:36876 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/errata/RHSA-2026:36877 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/errata/RHSA-2026:36878 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/errata/RHSA-2026:36879 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/errata/RHSA-2026:37136 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/errata/RHSA-2026:37137 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/errata/RHSA-2026:38505 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/errata/RHSA-2026:39188 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/errata/RHSA-2026:39189 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/security/cve/CVE-2026-29146 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://bugzilla.redhat.com/show_bug.cgi?id=2457020 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29146.json · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
EPSS history
Timeline
  • 09 APR 19:21Z
    Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default
    cvelistv5