CVE-2026-29146

HighCVSS 7.5

Published: 09/04/2026(UTC)Updated: 20/07/2026(UTC)Translated: 21/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

5.04%

91th percentile - higher than 91% of all known CVEs

Summary

Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. Allows an attacker to decrypt data transmitted over an encrypted channel.

Risk Assessment

An attacker can exploit this vulnerability to read sensitive data transmitted between Tomcat servers, leading to information disclosure.

Recommendation

It is recommended to immediately upgrade Apache Tomcat to versions 11.0.19, 10.1.53, or 9.0.116, which fix this vulnerability.

Original NVD description (English source)

Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.