Apache Tomcat und Tomcat Native: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 10

• High 7.5
  CVE-2026-34486 Exploited Public exploit Scanner template EPSS 99%

  Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor

  Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.…

  Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat org.apache.tomcat:tomcat-tribes Maven
  Apr 9, 2026

  KEV Aug 4, 2026
• Critical 9.1
  CVE-2026-29145 Public exploit

  Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled

  CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M7 through 10.1.52, from 9.0…

  Apache Software Foundation Apache Tomcat Apache Tomcat Native thingsboard-tb-node Debian Ubuntu Alpine Wolfi Maven
  Apr 9, 2026
• High 7.5
  CVE-2026-24880 Public exploit

  Apache Tomcat: Request smuggling via invalid chunk extension

  Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M1 throug…

  Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Maven
  Apr 9, 2026
• High 7.5
  CVE-2026-29129

  Apache Tomcat: TLS cipher order is not preserved

  Configured cipher preference order not preserved vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.0.115. Users are recommended to upgrade to version 11.0.20, 1…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Apr 9, 2026
• High 7.5
  CVE-2026-29146

  Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default

  Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Apr 9, 2026
• High 7.5
  CVE-2026-34483

  Apache Tomcat: Incomplete escaping of JSON access logs

  Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1.53, from 9.0.40 through 9.0.116. Users are recommended to…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Apr 9, 2026
• High 7.5
  CVE-2026-34487

  Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token

  Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Apr 9, 2026
• Medium 6.5
  CVE-2026-34500

  Apache Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled

  CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, from 9.0.92 through 9.0.116. …

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Apr 9, 2026
• Medium 6.1
  CVE-2026-25854 Public exploit

  Apache Tomcat: Occasionally open redirect

  Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M23 through 9.0.115, …

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Apr 9, 2026
• Medium 5.3
  CVE-2026-32990

  Apache Tomcat: Fix for CVE-2025-66614 is incomplete

  Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614. This issue affects Apache Tomcat: from 11.0.15 through 11.0.19, from 10.1.50 through 10.1.52, from 9.0.113 through 9.0.115. Users are recommended to upgrade t…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Apr 9, 2026

Revision history

1. 2026-11-12 #39

   Neue Updates von Rocky Enterprise Software Foundation aufgenommen

2. 2026-11-11 #38

   Neue Updates von Red Hat aufgenommen

3. 2026-11-05 #37

   Neue Updates von IBM aufgenommen

4. 2026-11-01 #36

   Neue Updates von Red Hat aufgenommen

5. 2026-10-29 #35

   Neue Updates von Red Hat aufgenommen

6. 2026-10-07 #34

   Neue Updates von Red Hat aufgenommen

7. 2026-09-27 #33

   Neue Updates von Rocky Enterprise Software Foundation aufgenommen

8. 2026-09-22 #32

   Neue Updates von Rocky Enterprise Software Foundation aufgenommen

9. 2026-09-21 #31

   Neue Updates von Oracle Linux aufgenommen

10. 2026-09-20 #30

    Neue Updates von Rocky Enterprise Software Foundation und Oracle Linux aufgenommen

11. 2026-09-17 #29

    Neue Updates von Red Hat aufgenommen

12. 2026-09-16 #28

    Neue Updates von SUSE aufgenommen

13. 2026-09-13 #27

    Neue Updates von Red Hat aufgenommen

14. 2026-09-03 #26

    Neue Updates von Red Hat aufgenommen

15. 2026-08-04 #25

    Exploit aufgenommen CVE-2026-34486

16. 2026-07-26 #24

    Neue Updates von Oracle Linux aufgenommen

17. 2026-07-23 #23

    Neue Updates von IBM aufgenommen

18. 2026-07-22 #22

    Neue Updates von Oracle Linux aufgenommen

19. 2026-07-21 #21

    Neue Updates von Oracle Linux aufgenommen

20. 2026-07-14 #20

    Neue Updates von Red Hat aufgenommen

21. 2026-07-12 #19

    Neue Updates von Rocky Enterprise Software Foundation und Red Hat aufgenommen

22. 2026-07-09 #18

    Neue Updates von Rocky Enterprise Software Foundation und Oracle Linux aufgenommen

23. 2026-07-08 #17

    Neue Updates von Red Hat aufgenommen

24. 2026-07-01 #16

    Neue Updates von IBM aufgenommen

25. 2026-06-29 #15

    Neue Updates von Oracle Linux aufgenommen

References

• Apache Tomcat 9 vulnerabilities vom 2026-04-09
  https://tomcat.apache.org/security-9.html
• Apache Tomcat 10 vulnerabilities vom 2026-04-09
  https://tomcat.apache.org/security-10.html
• Apache Tomcat 11 vulnerabilities vom 2026-04-09
  https://tomcat.apache.org/security-11.html
• openSUSE Security Update OPENSUSE-SU-2026:10548-1 vom 2026-04-15
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/QNEDM6RBHQEARIDUITXLNEYREGQXXWW5/
• openSUSE Security Update OPENSUSE-SU-2026:10549-1 vom 2026-04-15
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MEFQXVLFFJSJMLHOKAARZ4TAVX5QBSU5/
• openSUSE Security Update OPENSUSE-SU-2026:10547-1 vom 2026-04-15
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2ENRWN4ZNTHX5V7VJZHUZGDSHXMJHD2Y/
• SUSE Security Update SUSE-SU-2026:1558-1 vom 2026-04-23
  https://lists.suse.com/pipermail/sle-security-updates/2026-April/025569.html
• openSUSE Security Update OPENSUSE-SU-2026:20612-1 vom 2026-04-23
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/6JYOECIHMTZAXAOESLTCB5WLXF2FKMPT/
• openSUSE Security Update OPENSUSE-SU-2026:20611-1 vom 2026-04-23
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/M5H5Q3AIANVMCJDNLDOJKP7ZEVFCMTAL/
• SUSE Security Update SUSE-SU-2026:1572-1 vom 2026-04-23
  https://lists.suse.com/pipermail/sle-security-updates/2026-April/025601.html
• SUSE Security Update SUSE-SU-2026:1603-1 vom 2026-04-24
  https://lists.suse.com/pipermail/sle-security-updates/2026-April/025617.html
• SUSE Security Update SUSE-SU-2026:1604-1 vom 2026-04-24
  https://lists.suse.com/pipermail/sle-security-updates/2026-April/025616.html
• SUSE Security Update SUSE-SU-2026:21378-1 vom 2026-04-28
  https://lists.suse.com/pipermail/sle-security-updates/2026-April/025729.html
• SUSE Security Update SUSE-SU-2026:21379-1 vom 2026-04-28
  https://lists.suse.com/pipermail/sle-security-updates/2026-April/025728.html
• SUSE Security Update SUSE-SU-2026:21366-1 vom 2026-04-28
  https://lists.suse.com/pipermail/sle-security-updates/2026-April/025739.html
• Amazon Linux Security Advisory ALAS2TOMCAT9-2026-025 vom 2026-04-30
  https://alas.aws.amazon.com/AL2/ALAS2TOMCAT9-2026-025.html
• Red Hat Security Advisory RHSA-2026:12195 vom 2026-04-30
  https://access.redhat.com/errata/RHSA-2026:12195
• Red Hat Security Advisory RHSA-2026:12194 vom 2026-04-30
  https://access.redhat.com/errata/RHSA-2026:12194
• HCL Security Bulletin vom 2026-05-12
  https://support.hcl-software.com/community?id=community_blog&sys_id=2f600efd2bf4c7900c64f1a1d891bf19
• Red Hat Security Advisory RHSA-2026:20405 vom 2026-05-26
  https://access.redhat.com/errata/RHSA-2026:20405
• Red Hat Security Advisory RHSA-2026:20406 vom 2026-05-26
  https://access.redhat.com/errata/RHSA-2026:20406
• PoC CVE-2026-34486 vom 2026-05-28
  https://github.com/striga-ai/CVE-2026-34486
• Debian Security Advisory DLA-4619 vom 2026-06-07
  https://lists.debian.org/debian-lts-announce/2026/06/msg00008.html
• Debian Security Advisory DSA-6328 vom 2026-06-08
  https://security-tracker.debian.org/tracker/DSA-6328-1
• Debian Security Advisory DSA-6329 vom 2026-06-08
  https://security-tracker.debian.org/tracker/DSA-6329-1
• IBM Security Bulletin 7278011 vom 2026-06-25
  https://www.ibm.com/support/pages/node/7278011
• Oracle Linux Security Advisory ELSA-2026-26323 vom 2026-06-25
  https://linux.oracle.com/errata/ELSA-2026-26323.html
• Oracle Linux Security Advisory ELSA-2026-18916 vom 2026-06-29
  https://linux.oracle.com/errata/ELSA-2026-18916.html
• IBM Security Bulletin 7278738 vom 2026-07-01
  https://www.ibm.com/support/pages/node/7278738
• Red Hat Security Advisory RHSA-2026:36789 vom 2026-07-08
  https://access.redhat.com/errata/RHSA-2026:36789
• Red Hat Security Advisory RHSA-2026:36790 vom 2026-07-08
  https://access.redhat.com/errata/RHSA-2026:36790
• Red Hat Security Advisory RHSA-2026:36877 vom 2026-07-09
  https://access.redhat.com/errata/RHSA-2026:36877
• Red Hat Security Advisory RHSA-2026:36879 vom 2026-07-09
  https://access.redhat.com/errata/RHSA-2026:36879
• Red Hat Security Advisory RHSA-2026:36876 vom 2026-07-09
  https://access.redhat.com/errata/RHSA-2026:36876
• Red Hat Security Advisory RHSA-2026:36878 vom 2026-07-09
  https://access.redhat.com/errata/RHSA-2026:36878
• Red Hat Security Advisory RHSA-2026:37136 vom 2026-07-09
  https://access.redhat.com/errata/RHSA-2026:37136
• Oracle Linux Security Advisory ELSA-2026-36879 vom 2026-07-09
  https://linux.oracle.com/errata/ELSA-2026-36879.html
• Rocky Linux Security Advisory RLSA-2026:37137 vom 2026-07-10
  https://errata.build.resf.org/RLSA-2026:37137
• Oracle Linux Security Advisory ELSA-2026-37137 vom 2026-07-09
  https://linux.oracle.com/errata/ELSA-2026-37137.html
• Rocky Linux Security Advisory RLSA-2026:36788 vom 2026-07-10
  https://errata.build.resf.org/RLSA-2026:36788
• Rocky Linux Security Advisory RLSA-2026:36790 vom 2026-07-10
  https://errata.build.resf.org/RLSA-2026:36790
• Rocky Linux Security Advisory RLSA-2026:36879 vom 2026-07-10
  https://errata.build.resf.org/RLSA-2026:36879
• Red Hat Security Advisory RHSA-2026:38505 vom 2026-07-13
  https://access.redhat.com/errata/RHSA-2026:38505
• Red Hat Security Advisory RHSA-2026:39189 vom 2026-07-14
  https://access.redhat.com/errata/RHSA-2026:39189
• Oracle Linux Security Advisory ELSA-2026-18536 vom 2026-07-22
  https://linux.oracle.com/errata/ELSA-2026-18536.html
• Oracle Linux Security Advisory ELSA-2026-36788 vom 2026-07-21
  https://linux.oracle.com/errata/ELSA-2026-36788.html
• Oracle Linux Security Advisory ELSA-2026-18537 vom 2026-07-22
  https://linux.oracle.com/errata/ELSA-2026-18537.html
• Oracle Linux Security Advisory ELSA-2026-36790 vom 2026-07-22
  https://oss.oracle.com/pipermail/el-errata/2026-July/021227.html
• IBM Security Bulletin 7280950 vom 2026-07-23
  https://www.ibm.com/support/pages/node/7280950
• Oracle Linux Security Advisory ELSA-2026-25341 vom 2026-07-24
  https://linux.oracle.com/errata/ELSA-2026-25341.html
• Red Hat Security Advisory RHSA-2026:63137 vom 2026-09-03
  https://access.redhat.com/errata/RHSA-2026:63137
• Red Hat Security Advisory RHSA-2026:67164 vom 2026-09-14
  https://access.redhat.com/errata/RHSA-2026:67164
• SUSE Security Update SUSE-SU-2026:23691-1 vom 2026-09-16
  https://lists.suse.com/pipermail/sle-security-updates/2026-September/029187.html
• SUSE Security Update SUSE-SU-2026:23690-1 vom 2026-09-16
  https://lists.suse.com/pipermail/sle-security-updates/2026-September/029188.html
• SUSE Security Update SUSE-SU-2026:23700-1 vom 2026-09-16
  https://lists.suse.com/pipermail/sle-security-updates/2026-September/029183.html
• SUSE Security Update SUSE-SU-2026:23720-1 vom 2026-09-16
  https://lists.suse.com/pipermail/sle-security-updates/2026-September/029170.html
• SUSE Security Update SUSE-SU-2026:23710-1 vom 2026-09-16
  https://lists.suse.com/pipermail/sle-security-updates/2026-September/029175.html
• SUSE Security Update SUSE-SU-2026:23711-1 vom 2026-09-16
  https://lists.suse.com/pipermail/sle-security-updates/2026-September/029174.html
• Red Hat Security Advisory RHSA-2026:68651 vom 2026-09-17
  https://access.redhat.com/errata/RHSA-2026:68651
• Red Hat Security Advisory RHSA-2026:68679 vom 2026-09-17
  https://access.redhat.com/errata/RHSA-2026:68679
• Red Hat Security Advisory RHSA-2026:68678 vom 2026-09-17
  https://access.redhat.com/errata/RHSA-2026:68678
• Red Hat Security Advisory RHSA-2026:68660 vom 2026-09-17
  https://access.redhat.com/errata/RHSA-2026:68660
• Red Hat Security Advisory RHSA-2026:68659 vom 2026-09-17
  https://access.redhat.com/errata/RHSA-2026:68659
• Oracle Linux Security Advisory ELSA-2026-68660 vom 2026-09-18
  https://linux.oracle.com/errata/ELSA-2026-68660.html
• Rocky Linux Security Advisory RLSA-2026:68660 vom 2026-09-19
  https://errata.build.resf.org/RLSA-2026:68660
• Oracle Linux Security Advisory ELSA-2026-68651 vom 2026-09-18
  https://linux.oracle.com/errata/ELSA-2026-68651.html
• Rocky Linux Security Advisory RLSA-2026:68651 vom 2026-09-19
  https://errata.build.resf.org/RLSA-2026:68651
• Red Hat Security Advisory RHSA-2026:69259 vom 2026-09-21
  https://access.redhat.com/errata/RHSA-2026:69259
• Oracle Linux Security Advisory ELSA-2026-69259 vom 2026-09-21
  https://linux.oracle.com/errata/ELSA-2026-69259.html
• Rocky Linux Security Advisory RLSA-2026:69259 vom 2026-09-22
  https://errata.build.resf.org/RLSA-2026:69259
• Rocky Linux Security Advisory RLSA-2026:25341 vom 2026-09-28
  https://errata.build.resf.org/RLSA-2026:25341
• Red Hat Security Advisory RHSA-2026:76952 vom 2026-10-07
  https://access.redhat.com/errata/RHSA-2026:76952
• Red Hat Security Advisory RHSA-2026:92872 vom 2026-10-30
  https://access.redhat.com/errata/RHSA-2026:92872
• Red Hat Security Advisory RHSA-2026:93469 vom 2026-11-02
  https://access.redhat.com/errata/RHSA-2026:93469
• IBM Security Bulletin 7295802 vom 2026-11-06
  https://www.ibm.com/support/pages/node/7295802
• Red Hat Security Advisory RHSA-2026:99174 vom 2026-11-12
  https://access.redhat.com/errata/RHSA-2026:99174
• Rocky Linux Security Advisory RLSA-2026:99174 vom 2026-11-13
  https://errata.build.resf.org/RLSA-2026:99174