Critical Security Vulnerability in Apache Tomcat: Information Disclosure and Data Encryption Flaws
Summary
ALSA-2026:36879: Important: tomcat security, bug fix, and enhancement update. Affects tomcat versions < 1:9.0.117-2.el9_8. Fixed in 1:9.0.117-2.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Tomcat is a widely-used open-source servlet container that implements the Java Servlet and JavaServer Pages (JSP) specifications. It serves as a robust platform for running Java applications, providing features such as clustering, session management, and security configurations. However, recent vulnerabilities have raised concerns regarding its security, particularly in the EncryptInterceptor component, which is responsible for data encryption and decryption.
Vulnerability Detail
The vulnerabilities identified in Apache Tomcat include an Information Disclosure via Padding Oracle vulnerability (CVE-2026-29146) and a Missing Encryption of Sensitive Data due to EncryptInterceptor bypass (CVE-2026-34486). These vulnerabilities can lead to unauthorized access to sensitive information and compromise the confidentiality of data, potentially allowing attackers to exploit the weaknesses to decrypt sensitive data or gain insights into the application's inner workings.
How To Fix
Minimum fixed version
1:9.0.117-2.el9_8
This is the first release that contains the fix.
sudo dnf update tomcatTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to limit access to the affected components and implement additional security measures, such as using firewalls and access controls, to mitigate the risk of exploitation until the update is applied.
Conclusion
The vulnerabilities in Apache Tomcat pose significant risks to applications relying on this servlet container. It is crucial to update to the latest patched version to safeguard against potential exploits. Additionally, employing temporary workarounds and monitoring tools like Vulert can help maintain security until the update is implemented.
See every vulnerability recorded for tomcat →
FAQ
The vulnerabilities involve information disclosure and missing encryption of sensitive data, which can lead to unauthorized access and data breaches.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, implement access controls and monitor your application closely for any suspicious activity as a temporary measure.
Yes, configuring security settings in Tomcat, such as enabling SSL/TLS and restricting access to sensitive areas, can help mitigate risks.
Detailed information about the vulnerabilities can be found on the CVE pages: CVE-2026-29146 and CVE-2026-34486.
Related vulnerabilities
Recent vulnerabilities recorded for tomcat.
