Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream | tomcat | 1:9.0.87-2.el9_4 |
| Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream | tomcat-admin-webapps | 1:9.0.87-2.el9_4 |
| Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream | tomcat-docs-webapp | 1:9.0.87-2.el9_4 |
| Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream | tomcat-el-3.0-api | 1:9.0.87-2.el9_4 |
| Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream | tomcat-jsp-2.3-api | 1:9.0.87-2.el9_4 |
| Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream | tomcat-lib | 1:9.0.87-2.el9_4 |
| Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream | tomcat-servlet-4.0-api | 1:9.0.87-2.el9_4 |
| Red Hat · RHEL 9.4 E4S rhel_e4s:9.4::appstream | tomcat-webapps | 1:9.0.87-2.el9_4 |
Vulnerabilities 2
-
High 7.5
Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor
Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.…
KEV Aug 4, 2026 -
High 7.5
Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default
Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.…
References
-
article
https://access.redhat.com/security/updates/classification/#important
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2457020
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2457027
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_36876.json
-
report
https://access.redhat.com/security/cve/CVE-2026-29146
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-29146
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-29146
-
article
https://lists.apache.org/thread/lzt04z2pb3dc5tk85obn80xygw3z1p0w
-
report
https://access.redhat.com/security/cve/CVE-2026-34486
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-34486
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-34486
-
article
https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly
-
article
https://www.cisa.gov/known-exploited-vulnerabilities-catalog