Detections
Analytics

CVE-2026-29146

high

Description

Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.

References

https://lists.apache.org/thread/lzt04z2pb3dc5tk85obn80xygw3z1p0w

http://www.openwall.com/lists/oss-security/2026/04/09/24

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29146.json

https://bugzilla.redhat.com/show_bug.cgi?id=2457020

https://access.redhat.com/security/cve/CVE-2026-29146

https://access.redhat.com/errata/RHSA-2026:37137

https://access.redhat.com/errata/RHSA-2026:37136

https://access.redhat.com/errata/RHSA-2026:36879

https://access.redhat.com/errata/RHSA-2026:36878

https://access.redhat.com/errata/RHSA-2026:36877

https://access.redhat.com/errata/RHSA-2026:36876

https://access.redhat.com/errata/RHSA-2026:36790

https://access.redhat.com/errata/RHSA-2026:36789

https://access.redhat.com/errata/RHSA-2026:36788

https://access.redhat.com/errata/RHSA-2026:36787

https://access.redhat.com/errata/RHSA-2026:20406

https://access.redhat.com/errata/RHSA-2026:20405

Details

Source: Mitre, NVD

Published: 2026-04-09

Updated: 2026-07-09

Risk Information

CVSS v2

Base Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

Severity: High

CVSS v3

Base Score: 7.5

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Severity: High

CVSS v4

Base Score: 8.7

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Severity: High

EPSS

EPSS: 0.00018