GitHub Advisoryadvisory · Maven

GHSA-h468-7pvh-8vr8 Apache Tomcat: Padding Oracle vulnerability in EncryptInterceptor

HIGH Published 2026-04-09 Modified 2026-04-15 Official page ↗
Aliases
CVE-2026-29146
Ecosystem
Maven
Packages
org.apache.tomcat:tomcat-tribes, org.apache.tomcat:tomcat
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-209
Reviewed
2026-04-10

Affected packages

• Maven org.apache.tomcat:tomcat-tribes: >= 9.0.13, < 9.0.116 → fixed in 9.0.116 • Maven org.apache.tomcat:tomcat-tribes: >= 10.1.50, < 10.1.53 → fixed in 10.1.53 • Maven org.apache.tomcat:tomcat-tribes: >= 11.0.0-M1, < 11.0.20 → fixed in 11.0.20 • Maven org.apache.tomcat:tomcat: >= 9.0.13, < 9.0.116 → fixed in 9.0.116 • Maven org.apache.tomcat:tomcat: >= 10.1.50, < 10.1.53 → fixed in 10.1.53 • Maven org.apache.tomcat:tomcat: >= 11.0.0-M1, < 11.0.20 → fixed in 11.0.20 • Maven org.apache.tomcat:tomcat-tribes: >= 8.5.38, <= 8.5.100 (no fix yet) • Maven org.apache.tomcat:tomcat: >= 8.5.38, <= 8.5.100 (no fix yet) • Maven org.apache.tomcat:tomcat-tribes: >= 7.0.100, <= 7.0.109 (no fix yet) • Maven org.apache.tomcat:tomcat: >= 7.0.100, <= 7.0.109 (no fix yet)

Description

Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2026-29146 Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. vulnerability

Weakness · CWE (1)

  • CWE-209 Generation of Error Message Containing Sensitive Information weakness

References