CVE-2026-29146

HighCVSS 7.5/10Last modified Oct 26, 2026

Description

Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.

Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-209CWE-642CWE-1240

Affected software

VendorProductVersions
Apache Software FoundationApache Tomcat>= 11.0.0-M1, <= 11.0.18; >= 10.0.0-M1, <= 10.1.52; >= 9.0.13, <= 9.0.115; >= 8.5.38, <= 8.5.100; >= 7.0.100, <= 7.0.109
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support—
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support—
Red HatRed Hat Enterprise Linux 7 Extended Lifecycle Support—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service—
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.4 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support—
Red HatRed Hat JBoss Web Server 6.2.3—
Red HatRed Hat JBoss Web Server 6.2 on RHEL 10—
Red HatRed Hat JBoss Web Server 6.2 on RHEL 8—
Red HatRed Hat JBoss Web Server 6.2 on RHEL 9—
Red HatRed Hat JBoss Web Server 7.0.0—
Red HatRed Hat JBoss Web Server 7.0 on RHEL 10—
Red HatRed Hat JBoss Web Server 7.0 on RHEL 8—
Red HatRed Hat JBoss Web Server 7.0 on RHEL 9—
Red HatRed Hat Enterprise Linux 6—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat JBoss Web Server 5—

References

Timeline

Published
Apr 9, 2026
Last modified
Oct 26, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-29157.1HP System Event Utility might allow denial of service with elevated arbitrary file writes. This potential vulnerability was rCVE-2026-29164.3The Jeg Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.1 vCVE-2026-291679.8Use After Free vulnerability in Apache HTTP Server with mod_ldap in per-directory configuration This issue affects Apache HTTP Server: fromCVE-2026-291687.3Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's  mod_md via OCSP response data. This issue affecCVE-2026-291697.5A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicioCVE-2026-29175.4The Happy Addons for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, CVE-2026-291706.1A cross-site scripting vulnerability exists in mod_proxy_ftp's HTML directory list generation in Apache HTTP Server 2.4.67 and earlier when CVE-2026-291728.8Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, Craft Commerce is vulnerable to SQL Injection in the purchCVE-2026-291734.8Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.10.2 and 5.5.3, a stored XSS vulnerability exists when a user tries to updCVE-2026-291748.8Craft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, Craft Commerce is vulnerable to SQL Injection in the inventory levelsCVE-2026-291755.4Craft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, Stored XSS vulnerabilities exist in the Commerce Inventory page. The CVE-2026-291764.8Craft Commerce is an ecommerce platform for Craft CMS. Prior to 5.5.3, A stored XSS vulnerability exists in the Commerce Settings - Inventor
CVE-2026-29146: High severity, CVSS 7.5 | Vulnix