← CVE Intelligence

CVE-2026-29146

Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default PUBLISHED

Description (CNA)

Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.

Affected (CNA)

Vendor / productVersions
Apache Software Foundation / Apache Tomcataffected 11.0.0-M1 through 11.0.18; affected 10.0.0-M1 through 10.1.52; affected 9.0.13 through 9.0.115; affected 8.5.38 through 8.5.100; affected 7.0.100 through 7.0.109

CWE

No CWE identifiers supplied.

References

ADP enrichment

CVE

No English description supplied.

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A flaw was found in Apache Tomcat. This Padding Oracle vulnerability, present in the EncryptInterceptor with its default configuration, could allow a remote attacker to decrypt sensitive information. By exploiting weaknesses in the encryption padding, an attacker may be able to gain unauthorized access to data that should remain confidential.