CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2026-04-09
Apache Tomcat EncryptInterceptor Padding Oracle Vulnerability (CVE-2026-29146) Security Advisory
[Affected Scope] Apache Tomcat deployments utilizing EncryptInterceptor with default configurations for cluster membership protection (11.0.0-M1 to 11.0.18, 10.0.0-M1 to 10.1.52, 9.0.13 to 9.0.115, 8.5.38 to 8.5.100, 7.0.100 to 7.0.109).
[Impact] Remote attackers can intercept encrypted cluster traffic and perform a padding oracle attack to decrypt sensitive session data or cluster control messages without knowing the encryption key.
[Mitigation] Upgrade to fixed versions (11.0.19, 10.1.53, or 9.0.116) immediately, or configure the EncryptInterceptor to use secure authenticated encryption (e.g., GCM mode).