CVE-2026-29146

CVE Enrichment

CVSS: 7.5 HIGH
EPSS: 8.85%
EPSS Percentile: 95.17%
CISA KEV: Not listed

Description

Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 10-Apr-2026 03:16
Last Modified: 04-Aug-2026 20:18
EPSS Date: 2026-10-25
CWE: CWE-209, CWE-642, CWE-1240

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:N /
                            A:N

Affected Products / Versions

apache / tomcat
Version / affected range: * · from (inclusive) 7.0.100 · through (inclusive) 7.0.109
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
apache / tomcat
Version / affected range: * · from (inclusive) 8.5.38 · through (inclusive) 8.5.100
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
apache / tomcat
Version / affected range: * · from (inclusive) 9.0.13 · before (exclusive) 9.0.116
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
apache / tomcat
Version / affected range: * · from (inclusive) 10.0.0 · before (exclusive) 10.1.53
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*
apache / tomcat
Version / affected range: * · from (inclusive) 11.0.0 · before (exclusive) 11.0.20
cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*

References

Last enrichment sync: 26-Oct-2026 04:28
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

It stems from an incomplete fix for CVE-2026-29146, a critical vulnerability with a severity rating of 9.8 that is described as the missing encryption of sensitive data. CISA Orders Agencies to Mitigate Actively Exploited Flaws in Langflow, N-central and Tomcat
The flaw was introduced in March, with the patch for CVE-2026-29146, a padding oracle issue in EncryptInterceptor, an optional channel interceptor that encrypts messages transmitted between nodes in Tomcat clusters. CISA Warns of Exploitation Targeting Langflow, N-central and Tomcat Flaws

CVE (6)

Malware (1)

MITRE ATT&CK (1)

Vendors (2)

Products (3)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.