CVE-2026-29146

Modified Modified - Updated After Analysis

Padding Oracle Vulnerability in Apache Tomcat EncryptInterceptor

Publication date: 2026-04-09

Last updated on: 2026-06-30

Assigner: Apache Software Foundation

Description

Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-09

Last Modified

2026-06-30

Generated

2026-07-06

AI Q&A

2026-04-10

EPSS Evaluated

2026-07-05

NVD

CVE-2026-29146

EUVD

EUVD-2026-21012

Affected Vendors & Products

Vendor	Product	Version / Range
apache	tomcat	From 11.0.0 (inc) to 11.0.20 (exc)
apache	tomcat	From 9.0.13 (inc) to 9.0.116 (exc)
apache	tomcat	From 10.0.0 (inc) to 10.1.53 (exc)
apache	tomcat	From 7.0.100 (inc) to 7.0.109 (inc)
apache	tomcat	From 8.5.38 (inc) to 8.5.100 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-642	The product stores security-critical state information about its users, or the product itself, in a location that is accessible to unauthorized actors.
CWE-1240	To fulfill the need for a cryptographic primitive, the product implements a cryptographic algorithm using a non-standard, unproven, or disallowed/non-compliant cryptographic implementation.
CWE-209	The product generates an error message that includes sensitive information about its environment, users, or associated data.

Attack-Flow Graph

Compliance Impact

The provided information does not specify how the Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor affects compliance with common standards and regulations such as GDPR or HIPAA.

Impact Analysis

The vulnerability could allow an attacker to decrypt sensitive information that is supposed to be protected by encryption within Apache Tomcat. This could lead to unauthorized access to confidential data or compromise the security of applications relying on Tomcat's encryption.

Mitigation Strategies

Users are recommended to upgrade Apache Tomcat to versions 11.0.19, 10.1.53, or 9.0.116, which contain fixes for this Padding Oracle vulnerability in the EncryptInterceptor.

Executive Summary

This vulnerability is a Padding Oracle issue found in Apache Tomcat's EncryptInterceptor when used with its default configuration. A Padding Oracle vulnerability allows an attacker to decrypt encrypted data by exploiting the way padding errors are handled during decryption.

Hi! I’m here to help you understand CVE-2026-29146. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70