Back Linuxsecurity

Oracle 10 Tomcat Important Data Encryption Issues and Fixes ELSA-2026

Linuxsecurity •LinuxSecurity Advisories • July 28, 2026

Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges ×

[1:10.1.49-3] - Related: RHEL-168577 Remove unnecessary patch [1:10.1.49-2] - Resolves: RHEL-168577 Remove tomcat clustering JAR from RPM builds Resolves: CVE-2026-29146 tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor Resolves: CVE-2026-34486 tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass [1:10.1.36-3.el10_1.1] - Resolves: RHEL-150719 Certificate revocation bypass due to improper OCSP response validation (CVE-2026-24734)

tomcat-10.1.49-3.el10_2.noarch.rpm tomcat-admin-webapps-10.1.49-3.el10_2.noarch.rpm tomcat-docs-webapp-10.1.49-3.el10_2.noarch.rpm tomcat-el-5.0-api-10.1.49-3.el10_2.noarch.rpm tomcat-jsp-3.1-api-10.1.49-3.el10_2.noarch.rpm tomcat-lib-10.1.49-3.el10_2.noarch.rpm tomcat-servlet-6.0-api-10.1.49-3.el10_2.noarch.rpm tomcat-webapps-10.1.49-3.el10_2.noarch.rpm

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Oracle Tomcat Security Fixes Address Critical Vulnerabilities On July 28, 2026, Oracle released important security fixes for Tomcat versions 9 and 10, addressing multiple vulnerabilities. Key issues include CVE-2026-24734, a certificate revocation bypass, and CVE-2026-29146, which exposes sensitive data due to a padding oracle vulnerability in the EncryptInterceptor. Other vulnerabilities include CVE-2026-34487, which exposes Kubernetes bearer tokens, and CVE-2026-34486, allowing bypass of EncryptInterceptor protections. The vulnerabilities affect users of Apache Tomcat, particularly those running versions 9.0.117 and 10.1.49. Users are advised to audit Linux privileges to limit potential compromise and escalation. The fixes are critical for maintaining data integrity and security across affected systems. 10 sources 71

Extracted Entities

Oracle 10 Tomcat Important Data Encryption Issues and Fixes ELSA-2026

The full story

Extracted Entities

Attack Types (1)

CVEs (6)

CWE Weaknesses (1)

Platforms (2)