CVE-2026-29146: Apache Tomcat padding oracle vulnerability in EncryptInterceptor

CVE-2026-29146 · Severity: high · CVSS 7.5 · Published 2026-04-09

Apache Tomcat, a widely used web server for hosting Java applications, contains a security flaw in its data encryption component. This vulnerability could allow an attacker to decrypt sensitive information by observing how the server responds to specific encrypted messages. If exploited, this could lead to the exposure of confidential data handled by the web server.

Technologies: Apache Tomcat, org.apache.tomcat:tomcat (Maven), org.apache.tomcat:tomcat-tribes (Maven). Vendors: Apache, Maven, Red Hat.

Quick answers

Is CVE-2026-29146 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-29146 being exploited in the wild.
How severe is CVE-2026-29146?
High severity, with a CVSS score of 7.5, published 9 April 2026.
Which products and versions are affected?
Apache Tomcat 11.0.0-M1 through 11.0.18, 10.0.0-M1 through 10.1.52, 9.0.13 through 9.0.115, 8.5.38 through 8.5.100, 7.0.100 through 7.0.109; org.apache.tomcat:tomcat (Maven) ECOSYSTEM:introduced=9.0.13,fixed=9.0.116; org.apache.tomcat:tomcat-tribes (Maven) ECOSYSTEM:introduced=9.0.13,fixed=9.0.116; Red Hat JBoss Web Server 5, 6.2.3.
Is there a fix for CVE-2026-29146?
Yes. org.apache.tomcat:tomcat (Maven): upgrade to 9.0.116 or later; org.apache.tomcat:tomcat-tribes (Maven): upgrade to 9.0.116 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-29146 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-29146?
Check whether you run Apache Tomcat, org.apache.tomcat:tomcat (Maven), org.apache.tomcat:tomcat-tribes (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.tomcat:tomcat (Maven): upgrade to 9.0.116 or later
    # set org.apache.tomcat:tomcat to 9.0.116 in your pom.xml or build.gradle
  • org.apache.tomcat:tomcat-tribes (Maven): upgrade to 9.0.116 or later
    # set org.apache.tomcat:tomcat-tribes to 9.0.116 in your pom.xml or build.gradle

Technical details

A padding oracle vulnerability exists in Apache Tomcat's EncryptInterceptor when used with its default configuration. The flaw stems from the way the component handles cryptographic padding errors, which can be leveraged by a remote, unauthenticated attacker to decrypt ciphertext or recover sensitive information. This is classified as a side-channel attack where the attacker sends specifically crafted encrypted messages and observes the server's response (error messages or timing) to deduce the plaintext. The issue affects multiple major versions of Tomcat and has been addressed in versions 11.0.19, 10.1.53, and 9.0.116.

Affected products

  • Apache Tomcat 11.0.0-M1 through 11.0.18, 10.0.0-M1 through 10.1.52, 9.0.13 through 9.0.115, 8.5.38 through 8.5.100, 7.0.100 through 7.0.109
  • Red Hat JBoss Web Server 5, 6.2.3

Identifiers

  • CVE-2026-29146
  • GHSA-h468-7pvh-8vr8

Timeline

  • 2026-04-09: disclosed: Initial disclosure by Apache Software Foundation
  • 2026-04-09: advisory
  • 2026-05-26: patched: Red Hat released security updates for JBoss Web Server

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.