CVE-2026-34486
Encryption Bypass Vulnerability in Apache Tomcat EncryptInterceptor
Publication date: 2026-04-09
Last updated on: 2026-04-14
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | tomcat | 10.1.53 |
| apache | tomcat | 11.0.20 |
| apache | tomcat | 9.0.116 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-311 | The product does not encrypt sensitive or critical information before storage or transmission. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Missing Encryption of Sensitive Data issue in Apache Tomcat. It arises due to the fix for a previous vulnerability (CVE-2026-29146) which unintentionally allowed bypassing the EncryptInterceptor, a component responsible for encrypting sensitive data.
Affected versions include Apache Tomcat 11.0.20, 10.1.53, and 9.0.116. The issue is resolved in versions 11.0.21, 10.1.54, and 9.0.117.
What immediate steps should I take to mitigate this vulnerability?
Users are recommended to upgrade Apache Tomcat to versions 11.0.21, 10.1.54, or 9.0.117, which contain fixes for this vulnerability.
How can this vulnerability impact me? :
The vulnerability can lead to sensitive data not being properly encrypted, which increases the risk of data exposure or leakage. Attackers might exploit this to access confidential information that should have been protected by encryption.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability involves missing encryption of sensitive data in Apache Tomcat, which could potentially lead to exposure of sensitive information.
Since standards like GDPR and HIPAA require protection of sensitive data through encryption and other security measures, this vulnerability could negatively impact compliance with such regulations if exploited.
Users are advised to upgrade to fixed versions to mitigate this risk and maintain compliance.