Summary
[1:10.1.49-3]
- Related: RHEL-168577 Remove unnecessary patch
[1:10.1.49-2]
- Resolves: RHEL-168577 Remove tomcat clustering JAR from RPM builds
Resolves: CVE-2026-29146
tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor
Resolves: CVE-2026-34486
tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass
[1:10.1.36-3.el10_1.1]
- Resolves: RHEL-150719
Certificate revocation bypass due to improper OCSP response validation (CVE-2026-24734)
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | tomcat | 1:10.1.49-3.el10_2 |
| Oracle Linux · 10 | tomcat-admin-webapps | 1:10.1.49-3.el10_2 |
| Oracle Linux · 10 | tomcat-docs-webapp | 1:10.1.49-3.el10_2 |
| Oracle Linux · 10 | tomcat-el-5.0-api | 1:10.1.49-3.el10_2 |
| Oracle Linux · 10 | tomcat-jsp-3.1-api | 1:10.1.49-3.el10_2 |
| Oracle Linux · 10 | tomcat-lib | 1:10.1.49-3.el10_2 |
| Oracle Linux · 10 | tomcat-servlet-6.0-api | 1:10.1.49-3.el10_2 |
| Oracle Linux · 10 | tomcat-webapps | 1:10.1.49-3.el10_2 |
Vulnerabilities 2
-
High 7.5
Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor
Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.…
KEV Aug 4, 2026 -
High 7.5
Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default
Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.…