Skip to content
VulniPulse
Sign in
Highest advisory severityHigh 2 vendors · 3 advisories

CVE-2026-29146

CVE-2026-29146: 3 tracked advisory records across Apache, Red Hat. Compare vendor sources and published fix guidance.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Vendor advisory comparison

Apache

2 advisories
  • Advisory severityHigh7.5

    High [CVE-2026-29146 +1] Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor

    CVE-2026-34486Source published Source updated

    This bulletin covers 2 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

    Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

    Affected products in this advisory
    • Apache Tomcat
    Source-reported affected versions
    • Apache Tomcat 11.0.20
    • Apache Tomcat 10.1.53
    • Apache Tomcat 9.0.116
    Source-reported fixed versions
    • 11.0.21
    • 10.1.54
    • 9.0.117
    Mitigation guidance
    • Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.
    Full advisory and evidenceOpen source bulletin
  • Advisory severityHigh7.5

    High [CVE-2026-29146] Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default

    CVE-2026-29146Source published Source updated

    Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.

    Affected products in this advisory
    • Apache Tomcat
    Source-reported affected versions
    • Apache Tomcat 11.0.0-M1 through 11.0.18
    • Apache Tomcat 10.0.0-M1 through 10.1.52
    • Apache Tomcat 9.0.13 through 9.0.115
    • Apache Tomcat 8.5.38 through 8.5.100

    1 more entries in the full advisory.

    Source-reported fixed versions
    • 11.0.19
    • 10.1.53
    • 9.0.116
    Mitigation guidance
    • Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.
    Full advisory and evidenceOpen source bulletin

Red Hat

1 advisory
  • Advisory severityHigh7.5

    High [CVE-2026-29146] Information disclosure via Padding Oracle vulnerability in EncryptInterceptor

    CVE-2026-29146Source published

    Information disclosure via Padding Oracle vulnerability in EncryptInterceptor. Red Hat rates this important (CVSS 7.5). Weakness: CWE-1240. Affected package(s): jws6-tomcat. Resolved in Red Hat advisory RHSA-2026:20405 — update the affected packages (`sudo dnf update`).

    Affected products in this advisory
    • Red Hat Enterprise Linux 10.0 Extended Update Support
    • Red Hat Enterprise Linux 7 Extended Lifecycle Support
    • Red Hat Enterprise Linux 8.8 Telecommunications Update Service
    • Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions

    10 more entries in the full advisory.

    Source-reported affected versions
    • jws6-tomcat-0:10.1.49-13.redhat_00011.1.el10jws
    • jws6-tomcat-0:10.1.49-13.redhat_00011.1.el8jws
    • jws6-tomcat-0:10.1.49-13.redhat_00011.1.el9jws
    Source-reported fixed versions
    • RHSA-2026:20405
    Mitigation guidance
    • Update the affected package(s) to the fixed version shipped in RHSA-2026:20405 (`sudo dnf update` / `yum update`).
    Full advisory and evidenceOpen source bulletin

Android app · Google Play

Turn CVE research into alerts on your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features