ThreatCluster

Multiple Vulnerabilities in Apache Tomcat Expose Sensitive Data Risks

First seen 28 May 2026, 16:42 UTC nvd.nist.gov 87% similarity 69

Article Content

Browse articles
ThreatCluster

Two critical vulnerabilities have been identified in Apache Tomcat, CVE-2026-34486 and CVE-2026-29146. CVE-2026-34486 allows bypassing of the EncryptInterceptor due to missing encryption of sensitive data, affecting versions 11.0.20, 10.1.53, and 9.0.116. CVE-2026-29146 is a Padding Oracle vulnerability impacting earlier versions from 11.0.0-M1 to 11.0.18, among others. Users are urged to upgrade to the latest versions to mitigate these risks. The vulnerabilities were published on April 9, 2026, and the first public proof of concept for CVE-2026-34486 was released on April 15, 2026. The scope of impact includes a wide range of Apache Tomcat versions, making it critical for users to act promptly.

Key Points: • CVE-2026-34486 allows bypassing of encryption in Apache Tomcat versions 11.0.20, 10.1.53, and 9.0.116. • CVE-2026-29146 is a Padding Oracle vulnerability affecting multiple earlier versions of Tomcat. • Users are recommended to upgrade to the latest versions to mitigate these vulnerabilities.

ThreatCluster AI

Timeline

2026-04-09
CVE-2026-34486 published
CVE-2026-34486 was published, detailing a vulnerability in Apache Tomcat affecting several versions.
Article 1
2026-04-09
CVE-2026-29146 published
CVE-2026-29146 was published, describing a Padding Oracle vulnerability in Apache Tomcat.
Article 2
2026-04-15
First public PoC for CVE-2026-34486
The first public proof of concept for CVE-2026-34486 was released, demonstrating the vulnerability.
Article 1
Recent
Users urged to upgrade Apache Tomcat
Users are recommended to upgrade to versions 11.0.21, 10.1.54, or 9.0.117 to fix the vulnerabilities.
Article 1

Community

Browse all →

Tracked Entities in This Story