Most recent entries from all

ALSA-2026:36788 — Important: tomcat security, bug fix, and enhancement update

Affected: AlmaLinux:10: tomcat, AlmaLinux:10: tomcat-admin-webapps, AlmaLinux:10: tomcat-docs-webapp, AlmaLinux:10: tomcat-el-5.0-api, AlmaLinux:10: tomcat-jsp-3.1-api, AlmaLinux:10: tomcat-lib, AlmaLinux:10: tomcat-servlet-6.0-api, AlmaLinux:10: tomcat-webapps

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

* Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor (CVE-2026-29146) * Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass (CVE-2026-34486)

Bug Fix(es) and Enhancement(s):

* Remove tomcat clustering JAR from RPM builds (JIRA:AlmaLinux-168577)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-05544

BIT-tomcat-2026-34486 — Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor

Affected: Bitnami: tomcat

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.

This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

certfr-2026-avi-0418 — De multiples vulnérabilités ont été découvertes dans Apache Tomcat. Elles permettent à un attaquant de provoquer une at…

certfr-2026-avi-0418

cnvd-2026-31827

EUVD-2026-373225

fkie_cve-2026-34486

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.

This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

GHSA-69r9-qgr7-g2wj — Apache Tomcat Missing Encryption of Sensitive Data vulnerability

Affected: Maven: org.apache.tomcat:tomcat-tribes, Maven: org.apache.tomcat:tomcat

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.

This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

OESA-2026-1970 — tomcat security update

Affected: openEuler:24.03-LTS-SP3: tomcat, openEuler:20.03-LTS-SP4: tomcat, openEuler:22.03-LTS-SP4: tomcat, openEuler:24.03-LTS: tomcat, openEuler:24.03-LTS-SP1: tomcat, openEuler:24.03-LTS-SP2: tomcat

Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Security Fix(es):

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M1 through 9.0.115, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other, unsupported versions may also be affected.

Users are recommended to upgrade to version 11.0.20, 10.1.52 or 9.0.116, which fix the issue.(CVE-2026-24880)

Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M23 through 9.0.115, from 8.5.30 through 8.5.100. Other, unsupported versions may also be affected

Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.(CVE-2026-25854)

Configured cipher preference order not preserved vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.0.115.

Users are recommended to upgrade to version 11.0.20, 10.1.53…

openSUSE-SU-2026:10547-1 — tomcat-9.0.117-1.1 on GA media

tomcat-9.0.117-1.1 on GA media

RHSA-2026:36787 — Red Hat Security Advisory: tomcat security update

Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass

RLSA-2026:36788 — Important: tomcat security, bug fix, and enhancement update

Affected: Rocky Linux:10: tomcat

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

* Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor (CVE-2026-29146)

* Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass (CVE-2026-34486)

Bug Fix(es) and Enhancement(s):

* Remove tomcat clustering JAR from RPM builds (JIRA:Rocky Linux-168577)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SUSE-SU-2026:1572-1 — Security update for tomcat

Security update for tomcat

UBUNTU-CVE-2026-34486

Affected: Ubuntu:Pro:18.04:LTS: tomcat8

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

WID-SEC-W-2026-1038 — Apache Tomcat und Tomcat Native: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Apache Tomcat ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen, Open-Redirect-Angriffe durchzuführen und andere, nicht näher spezifizierte Angriffe auszuführen.