CVE-2026-29146: apache software foundation apache tomcat
CVSS: 7.5v3.1HighModified
AliasesUBUNTU-CVE-2026-29146DEBIAN-CVE-2026-29146CGA-47vf-g6qp-2h2cCGA-64c7-p6wg-hhw5CGA-ww8f-3gcx-3w44CGA-xwpf-4qpw-3p7rCGA-23jf-8949-65q4CGA-2f8j-8g9x-jh43CGA-2fh8-wq8m-fh8mCGA-33rr-gm95-6jcjCGA-3cpc-74vh-vq9pCGA-3hfv-cx5x-6w99CGA-3qv7-9mvw-vcp8CGA-4pwj-5v7h-6gr5CGA-5wwp-3662-ww7xCGA-632q-x62v-rm58CGA-6h32-hrwj-59h7CGA-6r5v-39h3-pfj8CGA-6vp5-4qjq-36w4CGA-9wwm-9pf5-5w3qCGA-c4q6-qw8g-7wh4CGA-c562-qm3h-vwrwCGA-c755-3r98-qcfmCGA-cw2m-38x8-gxhmCGA-f44r-vp38-ccc9CGA-grv2-pxrv-5qx5CGA-hjm9-xmhm-gr27CGA-hxmf-628x-pgfgCGA-j94h-532m-vrgqCGA-jfxm-h7rw-f2p8CGA-jgw5-xm5j-x4hrCGA-m3v3-c994-v8h3CGA-p7pv-x6vp-wxwhCGA-pm9r-67qh-69pmGHSA-h468-7pvh-8vr8BIT-tomcat-2026-29146CGA-qfp7-v93v-xmg7CGA-rp8v-64cc-94j6CGA-rw4f-3vw9-8wgqCGA-w8q2-5rrp-2w9jCGA-wrr8-4vh9-w5r8CGA-x5hg-wv43-5ppwCGA-x9gj-j98r-9wr6CGA-xp6m-7wch-fw5c
Published 09-04-2026Last modified 17-08-2026
Vulnerability summary
CVE-2026-29146 is a high (CVSS 7.5) vulnerability in apache software foundation apache tomcat. EPSS estimates a 2.89% chance of exploitation in the next 30 days, higher than 86.6% of scored vulnerabilities.
CVSS score
7.5/10
010
High · v3.1 (CVE.org)EPSS score
2.89%
0%100%
Low · -5.96 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 24 · Related 11MGASA-2026-0095OPENSUSE-SU-2026:10547-1OPENSUSE-SU-2026:10548-1OPENSUSE-SU-2026:10549-1OPENSUSE-SU-2026:20595-1OPENSUSE-SU-2026:20611-1OPENSUSE-SU-2026:20612-1RHSA-2026:20405RHSA-2026:36787RHSA-2026:36788RHSA-2026:36789RHSA-2026:36790RHSA-2026:36876RHSA-2026:36877RHSA-2026:36878RHSA-2026:36879RHSA-2026:37136RHSA-2026:37137RHSA-2026:38505RHSA-2026:39188SUSE-SU-2026:1558-1SUSE-SU-2026:1572-1SUSE-SU-2026:1603-1SUSE-SU-2026:1604-1CGA-RGJM-CQ2X-Q932
Timeline
- 09-04-2026PublishedVulnerability first disclosed.
- 17-08-2026Last modifiedVulnerability information updated.
Description
Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.
CVSS metrics
8 scores · 7 sources · 2 versionsHigh 8.7Preferred score · OSV · Maven (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:NSourcesSingle source
High 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSourcesAll 7 agree
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · MavenEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
2.89%
Chance of exploitation in the next 30 days
Percentile
87%
Versus all other CVEs
30-day change
-5.96 pp
From 8.85% on 18-09-2026
18-09-202618-10-2026
EPSS score2.89%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-209Generation of Error Message Containing Sensitive InformationThe product generates an error message that includes sensitive information about its environment, users, or associated data.
- CWE-642External Control of Critical State DataThe product stores security-critical state information about its users, or the product itself, in a location that is accessible to unauthorized actors.
- CWE-1240Use of a Cryptographic Primitive with a Risky ImplementationTo fulfill the need for a cryptographic primitive, the product implements a cryptographic algorithm using a non-standard, unproven, or disallowed/non-compliant cryptographic implementation.
Affected systems
Chainguard20 products
- camunda-8.8< 8.8.22-r0
- camunda-zeebe-8.6< 8.6.39-r0
- camunda-zeebe-8.7< 8.7.27-r0
- camunda-zeebe-8.8< 8.8.22-r0
- kayenta-2025.0< 2025.0.8-r10
Ubuntu4 products
- tomcat10All versions (No fix recorded)
- tomcat11All versions (No fix recorded)
- tomcat8All versions (No fix recorded)
- tomcat9All versions (No fix recorded)
Debian3 products
- tomcat10< 10.1.55-1~deb12u1 | < 10.1.55-1~deb13u1 | < 10.1.54-1
- tomcat11< 11.0.22-1~deb13u1 | < 11.0.21-1
- tomcat9< 9.0.70-2
Org.apache.tomcat2 products
- tomcat≥ 9.0.13, < 9.0.116 | ≥ 10.1.50, < 10.1.53 | ≥ 11.0.0-M1, < 11.0.20 | ≥ 8.5.38, ≤ 8.5.100 | ≥ 7.0.100, ≤ 7.0.109
- tomcat-tribes≥ 9.0.13, < 9.0.116 | ≥ 10.1.50, < 10.1.53 | ≥ 11.0.0-M1, < 11.0.20 | ≥ 8.5.38, ≤ 8.5.100 | ≥ 7.0.100, ≤ 7.0.109
Wolfi2 products
- thingsboard-tb-mqtt-transport< 4.3.1.1-r2
- thingsboard-tb-node< 4.3.1.1-r2
Apache1 product
- tomcat≥ 7.0.100, ≤ 7.0.109 | ≥ 8.5.38, ≤ 8.5.100 | ≥ 9.0.13, < 9.0.116 | ≥ 10.0.0, < 10.1.53 | ≥ 11.0.0, < 11.0.20
Apache software foundation1 product
- apache tomcat≥ 11.0.0-M1, ≤ 11.0.18 | ≥ 10.0.0-M1, ≤ 10.1.52 | ≥ 9.0.13, ≤ 9.0.115 | ≥ 8.5.38, ≤ 8.5.100 | ≥ 7.0.100, ≤ 7.0.109
7 vendors · 33 products
References
33 links- lists.apache.org/thread/lzt04z2pb3dc5tk85obn80xygw3z1p0wVendor AdvisoryREPORTAdvisoryWEBMailing List
Show all 33 references
- github.com/apache/tomcatPACKAGE