Junglewise Threat Intelligence

CVE-2026-29146: Apache Tomcat padding oracle vulnerability in EncryptInterceptor

CVE-2026-29146 · Severity: high · CVSS 7.5 · Published 2026-04-09

Technologies: Apache Tomcat. Vendors: Red Hat, Apache.

Executive brief

Apache Tomcat, a widely used web server for hosting Java applications, contains a security flaw in its data encryption component. This vulnerability could allow an attacker to decrypt sensitive information by observing how the server responds to specific encrypted messages. If exploited, this could lead to the exposure of confidential data handled by the web server.

Technical details

A padding oracle vulnerability exists in Apache Tomcat's EncryptInterceptor when used with its default configuration. The flaw stems from the way the component handles cryptographic padding errors, which can be leveraged by a remote, unauthenticated attacker to decrypt ciphertext or recover sensitive information. This is classified as a side-channel attack where the attacker sends specifically crafted encrypted messages and observes the server's response (error messages or timing) to deduce the plaintext. The issue affects multiple major versions of Tomcat and has been addressed in versions 11.0.19, 10.1.53, and 9.0.116.

Affected products

  • Apache Tomcat 11.0.0-M1 through 11.0.18, 10.0.0-M1 through 10.1.52, 9.0.13 through 9.0.115, 8.5.38 through 8.5.100, 7.0.100 through 7.0.109
  • Red Hat JBoss Web Server 5, 6.2.3

Timeline

  • 2026-04-09: disclosed: Initial disclosure by Apache Software Foundation
  • 2026-04-09: advisory
  • 2026-05-26: patched: Red Hat released security updates for JBoss Web Server

References

Related threats