{"id":"CVE-2026-29146","published":"2026-04-09T19:21:57Z","modified":"2026-08-17T12:05:18Z","title":"Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default","vendor":"Apache","product":"Apache Tomcat","tier":"tail","description":{"text":"Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.\n\nUsers are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.0885,"percentile":0.95185,"provenance":"source"},"cwes":[{"id":"CWE-209","name":"Generation of Error Message Containing Sensitive Information"},{"id":"CWE-642","name":"External Control of Critical State Data"},{"id":"CWE-1240","name":"Use of a Cryptographic Primitive with a Risky Implementation"}],"references":[{"url":"https://lists.apache.org/thread/lzt04z2pb3dc5tk85obn80xygw3z1p0w","tags":["vendor-advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/04/09/24","tags":[]},{"url":"https://access.redhat.com/security/cve/CVE-2026-29146","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2457020","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29146.json","tags":["x_sadp-csaf-vex"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20405","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:39188","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:38505","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36787","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36789","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36788","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36790","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:37137","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:37136","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36878","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36876","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36877","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36879","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20406","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:39189","tags":["vendor-advisory","x_refsource_REDHAT"]}],"priority":{"score":24.3,"factors":[{"name":"EPSS percentile","points":19.04},{"name":"CVSS severity","points":5.25}]},"vendorSlug":"apache","affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","versions":[">= 11.0.0-M1, <= 11.0.18",">= 10.0.0-M1, <= 10.1.52",">= 9.0.13, <= 9.0.115",">= 8.5.38, <= 8.5.100",">= 7.0.100, <= 7.0.109"]}],"affected":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat-tribes","vulnerableRanges":[">=9.0.13, <9.0.116",">=10.1.50, <10.1.53",">=11.0.0-M1, <11.0.20",">=8.5.38, <=8.5.100",">=7.0.100, <=7.0.109"],"patched":["9.0.116","10.1.53","11.0.20"],"from":["GHSA-h468-7pvh-8vr8"],"provenance":"source"},{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat","vulnerableRanges":[">=9.0.13, <9.0.116",">=10.1.50, <10.1.53",">=11.0.0-M1, <11.0.20",">=8.5.38, <=8.5.100",">=7.0.100, <=7.0.109"],"patched":["9.0.116","10.1.53","11.0.20"],"from":["GHSA-h468-7pvh-8vr8"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-21012","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-apache-tomcat-cve-2026-29146","children":[{"from":"CVE-2026-29146","to":"CVE-2026-34486","relation":"bypass","confidence":"high","kind":"lineage","orderedBy":"description","evidence":[{"kind":"text","provenance":"source","relation":"bypass","quote":"Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.","from":"NVD","in":"CVE-2026-34486"},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat-tribes","fromFixed":"9.0.116","toFixed":"9.0.117","daysApart":0},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat-tribes","fromFixed":"10.1.53","toFixed":"10.1.54","daysApart":0},{"kind":"similar","provenance":"machine","score":0.61,"basis":"same product + description similarity"}]}],"packageHistory":[{"cve":"CVE-2026-29146","published":"2026-04-09","fixed":"11.0.20","kev":false},{"cve":"CVE-2026-34486","published":"2026-04-09","fixed":"11.0.21","kev":true},{"cve":"CVE-2026-34487","published":"2026-04-09","fixed":"11.0.21","kev":false,"link":{"from":"CVE-2026-29146","to":"CVE-2026-34487","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat-tribes","fromFixed":"9.0.116","toFixed":"9.0.117","daysApart":0},{"kind":"version-step","provenance":"source","package":"Maven:org.apache.tomcat:tomcat-tribes","fromFixed":"10.1.53","toFixed":"10.1.54","daysApart":0}]}}],"package":"Maven:org.apache.tomcat:tomcat-tribes"}}