tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations

A flaw was found in Apache Tomcat. Insufficient technical documentation regarding the secure configuration of the EncryptInterceptor component may lead to deployments with insecure settings. This vulnerability could allow an attacker to exploit misconfigurations that arise from unclear guidance,...

tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations

A flaw was found in Apache Tomcat. Insufficient technical documentation regarding the secure configuration of the EncryptInterceptor component may lead to deployments with insecure settings. This vulnerability could allow an attacker to exploit misconfigurations that arise from unclear guidance,...

tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations

A flaw was found in Apache Tomcat. Insufficient technical documentation regarding the secure configuration of the EncryptInterceptor component may lead to deployments with insecure settings. This vulnerability could allow an attacker to exploit misconfigurations that arise from unclear guidance,...

Astra Linux – Vulnerability in Tomcat9

The documentation for Apache Tomcat versions 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62, and 8.5.38 to 8.5.78 states that the EncryptInterceptor enables Tomcat clustering to run over an untrusted network. However, this is incorrect. While the EncryptInterceptor does provide...

Astra Linux – Vulnerability in Tomcat9

The Padding Oracle vulnerability exists in Apache Tomcat’s EncryptInterceptor with the default configuration. This issue affects Apache Tomcat versions as follows: 11.0.0-M1 through 11.0.18, 10.0.0-M1 through 10.1.52, 9.0.13 through 9.0.115, 8.5.38 through 8.5.100, and 7.0.100 through 7.0.109...

tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations

A flaw was found in Apache Tomcat. Insufficient technical documentation regarding the secure configuration of the EncryptInterceptor component may lead to deployments with insecure settings. This vulnerability could allow an attacker to exploit misconfigurations that arise from unclear guidance,...

The vulnerability of the EncryptInterceptor component of the Apache Tomcat application server allows a hacker to compromise the confidentiality and integrity of the protected information.

The vulnerability of the EncryptInterceptor component in the Apache Tomcat application server is related to insufficient technical documentation. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality and integrity of the protected information...

Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.

Summary Maximo AI Service uses keras-3.14.1, bcprov-jdk18on-1.84.jar, sentencetransformers-5.2.0-py3-none-any.whl, pillow-12.2.0-cp311-cp311-manylinux227x8664.manylinux228x8664.whl, tomcat-embed-core-10.1.55.jar, langgraphsdk-0.3.13-py3-none-any.whl, and transformers-4.57.5-py3-none-any.whl which...

The vulnerability of the EncryptInterceptor module in the Apache Tomcat application server allows a hacker to perform a replay attack.

The vulnerability of the EncryptInterceptor module in the Apache Tomcat application server is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to carry out a replay attack...

Apache Tomcat 9.0.116 < 9.0.117 Missing Encryption of Sensitive Data Vulnerability (CVE-2026-34486)

The version of Tomcat installed on the remote host is 9.0.116 prior to 9.0.117. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat9.0.117security-9 advisory. - Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146...

MiracleLinux 9 : tomcat-9.0.117-2.el9_8 (AXSA:2026-1478:06)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1478:06 advisory. Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor CVE-2026-29146 Apache Tomcat: Apache...

OPENSUSE-SU-2026:21490-1 Security update for tomcat11

This update for tomcat11 fixes the following issues - Update to Tomcat 11.0.24 - CVE-2026-59083: Incorrect URL decoding in RewriteValve may allow security control bypass bsc1271397. - CVE-2026-59084: EncryptInterceptor requirements not clearly documented bsc1271398...

VulnCheck KEV: CVE-2026-34486

Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813...

CVE-2026-59084

A flaw was found in Apache Tomcat. Insufficient technical documentation regarding the secure configuration of the EncryptInterceptor component may lead to deployments with insecure settings. This vulnerability could allow an attacker to exploit misconfigurations that arise from unclear guidance,...

Exploit for Reliance on Untrusted Inputs in a Security Decision in Apache Tomcat

CVE-2026-34486: Apache Tomcat EncryptInterceptor Bypass | Fie...

Oracle Linux 10 : tomcat (ELSA-2026-36788)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-36788 advisory. - Resolves: RHEL-168577 Remove tomcat clustering JAR from RPM builds Resolves: CVE-2026-29146 tomcat: Apache Tomcat: Information disclosure via Paddi...

Alibaba Cloud Linux 3 : 0206: tomcat (ALINUX3-SA-2026:0206)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0206 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-29146: Padding Oracle vulnerabili...

BIT-TOMCAT-2026-59084 Apache Tomcat: EncryptInterceptor requirements not clearly documented

Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented. This issue affects Apache Tomcat: from 11.0.0 through 11.0.23, from 10.1.0 through 10.1.56, from 9.0.13 through 9.0.119, from 8.5.38...

SUSE CVE-2026-59084

Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.13 through 9.0.119, from...

MiracleLinux 8 : tomcat-9.0.87-2.el8_10 (AXSA:2026-1262:04)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1262:04 advisory. Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor CVE-2026-29146 Apache Tomcat: Apache...