Summary
Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.
Security Fix(es):
* Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor (CVE-2026-29146)
* Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass (CVE-2026-34486)
Bug Fix(es) and Enhancement(s):
* Remove tomcat clustering JAR from RPM builds (JIRA:AlmaLinux-168577)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 10 | tomcat | 1:10.1.49-3.el10_2.alma.1 |
| AlmaLinux · 10 | tomcat-admin-webapps | 1:10.1.49-3.el10_2.alma.1 |
| AlmaLinux · 10 | tomcat-docs-webapp | 1:10.1.49-3.el10_2.alma.1 |
| AlmaLinux · 10 | tomcat-el-5.0-api | 1:10.1.49-3.el10_2.alma.1 |
| AlmaLinux · 10 | tomcat-jsp-3.1-api | 1:10.1.49-3.el10_2.alma.1 |
| AlmaLinux · 10 | tomcat-lib | 1:10.1.49-3.el10_2.alma.1 |
| AlmaLinux · 10 | tomcat-servlet-6.0-api | 1:10.1.49-3.el10_2.alma.1 |
| AlmaLinux · 10 | tomcat-webapps | 1:10.1.49-3.el10_2.alma.1 |
Vulnerabilities 2
-
High 7.5
Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor
Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.…
KEV Aug 4, 2026 -
High 7.5
Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default
Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.…