High 1 exploited CVE ELSA-2026-36879 2 CVEs

Important: tomcat security, bug fix, and enhancement update (Oracle Linux 9)

Published Jul 8, 2026 · Updated Jul 8, 2026

Ecosystem: Oracle Linux

Summary

[1:9.0.117-2]
- Resolves: RHEL-183992 Remove tomcat clustering JAR from RPM builds
- Exclude i686 architecture from build

Fixed packages 8

Release	Package	Fixed in
Oracle Linux · 9	tomcat	1:9.0.117-2.el9_8
Oracle Linux · 9	tomcat-admin-webapps	1:9.0.117-2.el9_8
Oracle Linux · 9	tomcat-docs-webapp	1:9.0.117-2.el9_8
Oracle Linux · 9	tomcat-el-3.0-api	1:9.0.117-2.el9_8
Oracle Linux · 9	tomcat-jsp-2.3-api	1:9.0.117-2.el9_8
Oracle Linux · 9	tomcat-lib	1:9.0.117-2.el9_8
Oracle Linux · 9	tomcat-servlet-4.0-api	1:9.0.117-2.el9_8
Oracle Linux · 9	tomcat-webapps	1:9.0.117-2.el9_8

Vulnerabilities 2

High 7.5

CVE-2026-34486 Exploited Public exploit Scanner template EPSS 99%

Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.…

Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat org.apache.tomcat:tomcat-tribes Maven

Apr 9, 2026
KEV Aug 4, 2026
High 7.5

CVE-2026-29146

Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default

Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.…

Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven

Apr 9, 2026