CVE-2026-29146

3 known exploits for CVE-2026-29146

Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.

Affected products: Apache Tomcat, Confluence, Red Os, Rocky Linux
Apache Tomcat: ≤ 7.0.109, 8.5.100, 9.0.116, 10.1.53, 11.0.20

Fix: Available
CVSS 3.1: 7.5 HIGH
EPSS: 6.3% (93th percentile)
Weakness: CWE-209, CWE-642, CWE-1240
NVD status: Modified
Published: 2026-04-09

CVE-2026-29146 at NVD

Authoritative description, scoring and affected products

Exploit for Reliance on Untrusted Inputs in a Security Decision in Apache Tomcat

2026-07-23 razureinkGITHUB

Exploit for Missing Encryption of Sensitive Data in Apache Tomcat

2026-04-15 AirSkyeGITHUB

2026-04-09 apacheUNKNOWN