Vulnerabilities CVE-2026-29146

CVE-2026-29146

None

Open

TLP:CLEAR

Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.

Details

EPSS Score ⓘ: 6.26%

93th percentile
Confidence: 90%
Published: Apr 9, 2026
Last Modified: Aug 17, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.