Critical Security Update for tomcat9: Addressing Information Disclosure and Data Encryption Vulnerabilities
Summary
ALSA-2026:36790: Important: tomcat9 security, bug fix, and enhancement update. Affects tomcat9 versions < 1:9.0.117-2.el10_2.alma.1. Fixed in 1:9.0.117-2.el10_2.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Tomcat is a widely used servlet container that serves as the reference implementation for Java Servlet and JavaServer Pages technologies. It is developed under the Apache Software License version 2.0 and is known for its collaborative development environment. Tomcat is essential for running Java-based web applications, providing features such as clustering, session management, and security configurations. However, recent vulnerabilities have been identified that could compromise sensitive data and application integrity.
Vulnerability Detail
The vulnerabilities identified in tomcat9 include an information disclosure issue due to a Padding Oracle vulnerability in the EncryptInterceptor (CVE-2026-29146) and a missing encryption of sensitive data caused by an EncryptInterceptor bypass (CVE-2026-34486). These vulnerabilities can lead to unauthorized access to sensitive information and potential data breaches, making it critical for users to address them promptly.
How To Fix
Minimum fixed version
1:9.0.117-2.el10_2.alma.1
This is the first release that contains the fix.
sudo dnf update tomcat9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider disabling the affected features in tomcat9 until the update can be applied. This may involve modifying configuration files to limit access to sensitive data and ensuring that encryption is enforced in your application.
Conclusion
The vulnerabilities in tomcat9 pose significant risks to applications relying on this servlet container. It is crucial for users to update to the patched version to mitigate these risks and protect sensitive data. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for tomcat9 →
FAQ
The main vulnerabilities are related to information disclosure and missing encryption of sensitive data due to issues in the EncryptInterceptor.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file. Visit Vulert Scanner to check your application without needing to sign up.
If an immediate update is not possible, consider disabling the affected features or implementing additional security measures to protect sensitive data.
These vulnerabilities can lead to unauthorized access to sensitive information, potentially resulting in data breaches and loss of user trust.
For detailed information, refer to the CVE pages for CVE-2026-29146 and CVE-2026-34486.
Related vulnerabilities
Recent vulnerabilities recorded for tomcat9.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
