Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-29146 Details

Description

Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: redhat-SADPCVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://access.redhat.com/errata/RHSA-2026:20405	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:20406	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:36787	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:36788	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:36789	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:36790	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:36876	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:36877	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:36878	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:36879	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:37136	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:37137	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:38505	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:39188	redhat-SADP
https://access.redhat.com/errata/RHSA-2026:39189	redhat-SADP
https://access.redhat.com/security/cve/CVE-2026-29146	redhat-SADP
https://bugzilla.redhat.com/show_bug.cgi?id=2457020	redhat-SADP
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29146.json	redhat-SADP
http://www.openwall.com/lists/oss-security/2026/04/09/24	CVE	Mailing ListThird Party Advisory
https://lists.apache.org/thread/lzt04z2pb3dc5tk85obn80xygw3z1p0w	[email protected]	Mailing ListVendor Advisory

see all 20 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-1240	Use of a Cryptographic Primitive with a Risky Implementation	redhat-SADP
CWE-209	Generation of Error Message Containing Sensitive Information	CISA-ADP
CWE-642	External Control of Critical State Data	CISA-ADP

Affected Products

Product	Versions
apache tomcat	>= 7.0.100, <= 7.0.109 >= 8.5.38, <= 8.5.100 >= 9.0.13, < 9.0.116 >= 10.0.0, < 10.1.53 >= 11.0.0, < 11.0.20
CPE cpe:2.3:a:apache:tomcat:::::::: Remediation No remediation found in references.

Change History

12 change records found show changes

Date	Action	Recorded By
Aug 4, 2026	CVE Modified	redhat-SADP
Jul 20, 2026	CVE Modified	redhat-SADP
Jul 15, 2026	CVE Modified	redhat-SADP
Jul 13, 2026	CVE Modified	redhat-SADP
Jul 9, 2026	CVE Modified	redhat-SADP
Jun 30, 2026	CVE Modified	redhat-SADP
Jun 17, 2026	CVE Modified	CISA-ADP
Jun 17, 2026	CVE Modified	[email protected]
Apr 14, 2026	Initial Analysis	[email protected]
Apr 10, 2026	CVE Modified	CISA-ADP
Apr 10, 2026	CVE Modified	CVE
Apr 9, 2026	New CVE Received	[email protected]