HIGH CWE-209
CVE-2026-29146
Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default
Apache·Tomcat
7.5/ 10
CVSS 3.1
High severity
8.9%
EPSS exploit odds
Chance of exploitation in the next 30 days
Higher than 95% of all CVEs
Not listed
CISA KEV catalog
No confirmed in-the-wild exploitation on CISA's list.
Timeline
- Published
- Apr 9, 2026
- Updated
- Aug 17, 2026
- First covered
- Aug 5, 2026
- Latest story
- 3 months ago
Summary
Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109.Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.
CWE-209Generation of Error Message Containing Sensitive Information
Attack profile
Attack vectorNetwork
ComplexityLow
PrivilegesNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityNone
AvailabilityNone
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NAffected products
- Apache Tomcat11.0.0-M1 to 11.0.1810.0.0-M1 to 10.1.529.0.13 to 9.0.1158.5.38 to 8.5.100