NetSight
IP …
high7.5

CVE-2026-29146

Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration.

Impact

Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.apache.tomcat:tomcat>= 9.0.13, < 9.0.1169.0.116
mavenorg.apache.tomcat:tomcat-tribes>= 9.0.13, < 9.0.1169.0.116

Affected products

VendorProductAffected versions
ApacheTomcat
from 7.0.100 through 7.0.109
from 8.5.38 through 8.5.100
from 9.0.13 before 9.0.116
from 10.0.0 before 10.1.53
from 11.0.0 before 11.0.20

Weakness classification

CWE-209CWE-642CWE-1240

References