CVE-2026-29146

HIGH

Apache Tomcat: Padding Oracle vulnerability in EncryptInterceptor

Published April 9, 2026Updated April 16, 2026Source: osv

Summary

Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.

Remediation

Upgrade to the fixed version using your package manager.

Maven

Update org.apache.tomcat:tomcat-tribes to 10.1.53 or later

<!-- Update pom.xml dependency version to 10.1.53 for org.apache.tomcat:tomcat-tribes -->

Maven

Update org.apache.tomcat:tomcat-tribes to 11.0.20 or later

<!-- Update pom.xml dependency version to 11.0.20 for org.apache.tomcat:tomcat-tribes -->

Maven

Update org.apache.tomcat:tomcat-tribes to 9.0.116 or later

<!-- Update pom.xml dependency version to 9.0.116 for org.apache.tomcat:tomcat-tribes -->

Maven

Update org.apache.tomcat:tomcat to 11.0.20 or later

<!-- Update pom.xml dependency version to 11.0.20 for org.apache.tomcat:tomcat -->

Maven

Update org.apache.tomcat:tomcat to 9.0.116 or later

<!-- Update pom.xml dependency version to 9.0.116 for org.apache.tomcat:tomcat -->

Maven

Update org.apache.tomcat:tomcat to 10.1.53 or later

<!-- Update pom.xml dependency version to 10.1.53 for org.apache.tomcat:tomcat -->

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (10)

Package	Ecosystem	Affected	Fixed In
org.apache.tomcat:tomcat-tribes	maven	8.5.100, 8.5.38, 8.5.39, 8.5.40 (+52 more)	Range-based data available
org.apache.tomcat:tomcat	maven	8.5.100, 8.5.38, 8.5.39, 8.5.40 (+52 more)	Range-based data available
org.apache.tomcat:tomcat-tribes	maven	10.1.50, 10.1.52	10.1.53
org.apache.tomcat:tomcat-tribes	maven	11.0.0, 11.0.0-M1, 11.0.0-M10, 11.0.0-M11 (+36 more)	11.0.20
org.apache.tomcat:tomcat-tribes	maven	9.0.100, 9.0.102, 9.0.104, 9.0.105 (+81 more)	9.0.116
org.apache.tomcat:tomcat	maven	11.0.0, 11.0.0-M1, 11.0.0-M10, 11.0.0-M11 (+36 more)	11.0.20
org.apache.tomcat:tomcat	maven	7.0.100, 7.0.103, 7.0.104, 7.0.105 (+4 more)	Range-based data available
org.apache.tomcat:tomcat-tribes	maven	7.0.100, 7.0.103, 7.0.104, 7.0.105 (+4 more)	Range-based data available
org.apache.tomcat:tomcat	maven	9.0.100, 9.0.102, 9.0.104, 9.0.105 (+81 more)	9.0.116
org.apache.tomcat:tomcat	maven	10.1.50, 10.1.52	10.1.53

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-209
View on MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 7.5 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

Frequently Asked Questions

What is CVE-2026-29146?: Apache Tomcat: Padding Oracle vulnerability in EncryptInterceptor This vulnerability has been assigned a severity rating of HIGH (CVSS score: 7.5/10).
How do I check if my project is affected by CVE-2026-29146?: CVE-2026-29146 affects org.apache.tomcat:tomcat-tribes and org.apache.tomcat:tomcat. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-29146 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

7.5

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-h468-7pvh-8vr8

BIT-tomcat-2026-29146

Related CVEs

CVE-2026-43515
CRITICAL
Apache Tomcat - Security constraints not correctly applied
CVE-2026-29145
CRITICAL
Apache Tomcat: CLIENT_CERT authentication does not fail as expected
CVE-2009-3555
CRITICAL
Apache Tomcat affected by vulnerability in TLS and SSL protocol
CVE-2026-43513
HIGH
Apache Tomcat: LockOutRealm treats user names as case-sensitive
CVE-2026-29129
HIGH
Apache Tomcat: Configured cipher preference order not preserved
CVE-2026-34486
HIGH
Apache Tomcat Missing Encryption of Sensitive Data vulnerability
CVE-2026-34487
HIGH
Apache Tomcat vulnerable to Insertion of Sensitive Information into Log File
CVE-2025-49124
MEDIUM
Apache Tomcat installer for Windows has an untrusted search path vulnerability

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies