Apache Tomcat: Padding Oracle vulnerability in EncryptInterceptor

🗓️ 09 Apr 2026 21:31:29Reported by GitHub Advisory DatabaseType

Padding Oracle in Tomcat EncryptInterceptor with default config; upgrade to 11.0.19, 10.1.53, or 9.0.116.

Reporter	Title	Published	Views	Family All 103
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM DataStax Enterprise	27 May 202617:14	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for April 2026	30 Apr 202611:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Integration Bus for z/OS is vulnerable to multiple vulnerabilities due to Apache Tomcat	14 May 202614:09	–	ibm
GithubExploit	Exploit for Missing Encryption of Sensitive Data in Apache Tomcat	15 Apr 202607:30	–	githubexploit
ATTACKERKB	CVE-2026-29146	9 Apr 202619:21	–	attackerkb
ATTACKERKB	CVE-2026-34486	9 Apr 202619:35	–	attackerkb
Tenable Nessus	Amazon Linux 2023 : tomcat9, tomcat9-admin-webapps, tomcat9-el-3.0-api (ALAS2023-2026-1672)	20 May 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : tomcat10, tomcat10-admin-webapps, tomcat10-el-5.0-api (ALAS2023-2026-1673)	20 May 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2 : tomcat, --advisory ALAS2TOMCAT9-2026-025 (ALASTOMCAT9-2026-025)	30 Apr 202600:00	–	nessus
Tenable Nessus	Atlassian Confluence 9.1.0 < 9.2.20 / 9.3.1 < 10.2.11 (CONFSERVER-103647)	26 May 202600:00	–	nessus

Vulners

Node

org.apache.tomcat tomcatRange7.0.100–7.0.109maven

org.apache.tomcat tomcatRange8.5.38–8.5.100maven

org.apache.tomcat tomcatRange11.0.0-M1–11.0.18maven

org.apache.tomcat tomcatRange10.1.50–10.1.53maven

org.apache.tomcat tomcatRange9.0.13–9.0.116maven

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-29146
lists	www.lists.apache.org/thread/lzt04z2pb3dc5tk85obn80xygw3z1p0w
openwall	www.openwall.com/lists/oss-security/2026/04/09/24
github	www.github.com/apache/tomcat/commit/0112ed22abfccc3d54e44d91eb08804d0886acd1
github	www.github.com/apache/tomcat/commit/607ebc0fa522bd9e8c05517baa2d179bbd1e659c
github	www.github.com/apache/tomcat/commit/6d955cceca841f2eabf2d6c46b59a8c7e1cd6eaa
tomcat	www.tomcat.apache.org/security-10.html
tomcat	www.tomcat.apache.org/security-11.html
tomcat	www.tomcat.apache.org/security-9.html
herodevs	www.herodevs.com/vulnerability-directory/cve-2026-29146

15 Apr 2026 21:33Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.5

EPSS0.12919

SSVC