{"id":"CVE-2026-34486","state":"PUBLISHED","title":"Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor","description":"Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.\n\nThis issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.\n\nUsers are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.","publishedAt":"2026-04-09T19:35:35.994Z","updatedAt":"2026-09-21T19:43:41.203Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"CISA-ADP"},"assigner":"apache","products":["Apache Software Foundation Apache Tomcat"],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","defaultStatus":"unaffected","versions":[{"version":"11.0.20","status":"affected","versionType":"semver"},{"version":"10.1.53","status":"affected","versionType":"semver"},{"version":"9.0.116","status":"affected","versionType":"semver"}]}],"references":["https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly","https://socradar.io/blog/snowlight-government-chinese-campaign/","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34486","https://www.vicarius.io/vsociety/posts/cve-2026-34486-detection-script-rce-on-apache-tomcat","https://www.vicarius.io/vsociety/posts/cve-2026-34486-mitigation-script-rce-on-apache-tomcat","https://access.redhat.com/security/cve/CVE-2026-34486","https://bugzilla.redhat.com/show_bug.cgi?id=2457027","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json","https://access.redhat.com/errata/RHSA-2026:39188","https://access.redhat.com/errata/RHSA-2026:38505","https://access.redhat.com/errata/RHSA-2026:36787","https://access.redhat.com/errata/RHSA-2026:36789","https://access.redhat.com/errata/RHSA-2026:36788","https://access.redhat.com/errata/RHSA-2026:36790","https://access.redhat.com/errata/RHSA-2026:37137","https://access.redhat.com/errata/RHSA-2026:37136","https://access.redhat.com/errata/RHSA-2026:36878","https://access.redhat.com/errata/RHSA-2026:36876","https://access.redhat.com/errata/RHSA-2026:36877","https://access.redhat.com/errata/RHSA-2026:36879","https://access.redhat.com/errata/RHSA-2026:39189"],"weaknesses":["CWE-311","CWE-807"],"ingestedAt":"2026-10-29T20:11:40.391Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/34xxx/CVE-2026-34486.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-34486","state":"PUBLISHED","datePublished":"2026-04-09T19:35:35.994Z","dateUpdated":"2026-09-21T19:43:41.203Z","assignerShortName":"apache","assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","dateReserved":"2026-03-30T07:57:49.315Z"},"containers":{"cna":{"title":"Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor","descriptions":[{"lang":"en","value":"Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.\n\nThis issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.\n\nUsers are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue."}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","defaultStatus":"unaffected","versions":[{"version":"11.0.20","status":"affected","versionType":"semver"},{"version":"10.1.53","status":"affected","versionType":"semver"},{"version":"9.0.116","status":"affected","versionType":"semver"}]}],"references":[{"url":"https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly","tags":["vendor-advisory"]}],"metrics":[{"other":{"content":{"text":"important"},"type":"Textual description of severity"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-311","description":"CWE-311 Missing Encryption of Sensitive Data","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"apache","orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","dateUpdated":"2026-04-09T19:35:35.994Z"},"credits":[{"lang":"en","type":"finder","value":"Bartlomiej Dmitruk at striga.ai"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://socradar.io/blog/snowlight-government-chinese-campaign/","tags":["third-party-advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34486","tags":["government-resource"]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-08-07T03:55:21.600269Z","id":"CVE-2026-34486","options":[{"Exploitation":"active"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}},{"other":{"type":"kev","content":{"dateAdded":"2026-08-04","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34486"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-21T19:43:41.203Z"}},{"title":"CVE Program Container","references":[{"url":"https://www.vicarius.io/vsociety/posts/cve-2026-34486-detection-script-rce-on-apache-tomcat"},{"url":"https://www.vicarius.io/vsociety/posts/cve-2026-34486-mitigation-script-rce-on-apache-tomcat"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2026-05-26T18:16:14.258Z"},"x_generator":{"engine":"ADPogram 0.0.1"}},{"title":"Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass","descriptions":[{"lang":"en","value":"A flaw was found in Apache Tomcat. This vulnerability, categorized as Missing Encryption of Sensitive Data, arises from a bypass in the EncryptInterceptor, a component designed to ensure data encryption. This bypass, introduced as a fix for CVE-2026-29146, allows sensitive data to remain unencrypted, potentially leading to information disclosure."}],"affected":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"tomcat","defaultStatus":"affected","versions":[{"version":"1:10.1.49-3.el10_2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"tomcat9","defaultStatus":"affected","versions":[{"version":"1:9.0.117-2.el10_2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","packageName":"tomcat","defaultStatus":"affected","versions":[{"version":"1:10.1.36-2.el10_0","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","packageName":"tomcat9","defaultStatus":"affected","versions":[{"version":"1:9.0.87-6.el10_0","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7 Extended Lifecycle Support","packageName":"tomcat","defaultStatus":"affected","versions":[{"version":"0:7.0.76-18.el7_9","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"tomcat","defaultStatus":"affected","versions":[{"version":"1:9.0.87-2.el8_10","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.8 Telecommunications Update Service","packageName":"tomcat","defaultStatus":"affected","versions":[{"version":"1:9.0.87-2.el8_8","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_tus:8.8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions","packageName":"tomcat","defaultStatus":"affected","versions":[{"version":"1:9.0.87-2.el8_8","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:8.8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"tomcat","defaultStatus":"affected","versions":[{"version":"1:9.0.117-2.el9_8","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","packageName":"tomcat","defaultStatus":"affected","versions":[{"version":"1:9.0.87-2.el9_2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.2"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","packageName":"tomcat","defaultStatus":"affected","versions":[{"version":"1:9.0.87-2.el9_4","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.4"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","packageName":"tomcat","defaultStatus":"affected","versions":[{"version":"1:9.0.87-4.el9_6","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.6"]},{"vendor":"Red Hat","product":"Red Hat JBoss Web Server 7.0.0","packageName":"tomcat","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_web_server:7.0"]},{"vendor":"Red Hat","product":"Red Hat JBoss Web Server 7.0 on RHEL 10","packageName":"jws7-tomcat","defaultStatus":"affected","versions":[{"version":"0:11.0.21-5.redhat_00004.1.el10jws","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_web_server:7.0::el10"]},{"vendor":"Red Hat","product":"Red Hat JBoss Web Server 7.0 on RHEL 8","packageName":"jws7-tomcat","defaultStatus":"affected","versions":[{"version":"0:11.0.21-5.redhat_00004.1.el8jws","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_web_server:7.0::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Web Server 7.0 on RHEL 9","packageName":"jws7-tomcat","defaultStatus":"affected","versions":[{"version":"0:11.0.21-5.redhat_00004.1.el9jws","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_web_server:7.0::el9"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"tomcat6","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"pki-deps:10.6/pki-servlet-engine","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"pki-servlet-engine","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat JBoss Web Server 5","packageName":"tomcat","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_web_server:5"]},{"vendor":"Red Hat","product":"Red Hat JBoss Web Server 6","packageName":"tomcat","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_web_server:6"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-34486","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2457027","name":"RHBZ#2457027","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json","tags":["x_sadp-csaf-vex"]},{"url":"https://access.redhat.com/errata/RHSA-2026:39188","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:38505","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36787","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36789","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36788","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36790","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:37137","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:37136","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36878","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36876","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36877","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36879","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:39189","tags":["vendor-advisory","x_refsource_REDHAT"]}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Important"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-807","description":"Reliance on Untrusted Inputs in a Security Decision","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat-SADP","orgId":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","dateUpdated":"2026-08-10T12:05:44.488Z"},"datePublic":"2026-04-09T19:35:35.994Z","solutions":[{"lang":"en","value":"RHSA-2026:39188: Red Hat JBoss Web Server 7.0 on RHEL 10, Red Hat JBoss Web Server 7.0 on RHEL 8, Red Hat JBoss Web Server 7.0 on RHEL 9"},{"lang":"en","value":"RHSA-2026:38505: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS)"},{"lang":"en","value":"RHSA-2026:36787: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"},{"lang":"en","value":"RHSA-2026:36789: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"},{"lang":"en","value":"RHSA-2026:36788: Red Hat Enterprise Linux AppStream (v. 10)"},{"lang":"en","value":"RHSA-2026:36790: Red Hat Enterprise Linux AppStream (v. 10)"},{"lang":"en","value":"RHSA-2026:37137: Red Hat Enterprise Linux AppStream (v. 8)"},{"lang":"en","value":"RHSA-2026:37136: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)"},{"lang":"en","value":"RHSA-2026:36878: Red Hat Enterprise Linux AppStream E4S (v.9.2)"},{"lang":"en","value":"RHSA-2026:36876: Red Hat Enterprise Linux AppStream E4S (v.9.4)"},{"lang":"en","value":"RHSA-2026:36877: Red Hat Enterprise Linux AppStream EUS (v.9.6)"},{"lang":"en","value":"RHSA-2026:36879: Red Hat Enterprise Linux AppStream (v. 9)"},{"lang":"en","value":"RHSA-2026:39189: Red Hat JBoss Web Server 7.0.0"}],"timeline":[{"lang":"en","time":"2026-04-09T20:01:26.022Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-04-09T19:35:35.994Z","value":"Made public."}],"workarounds":[{"lang":"en","value":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}],"x_adpType":"supplier","x_generator":{"engine":"sadp-cli 1.0.0"}}]}}}