CVE-2026-29146: Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default

Security readout for executives and security teams

Apache Tomcat has a high-severity confidentiality flaw in EncryptInterceptor when used with its default configuration. An unauthenticated network attacker may be able to use padding-oracle behavior to recover protected information. Exposure depends on whether affected Tomcat versions use this interceptor, not merely whether Tomcat is installed. Highest concern is internet- or network-reachable Tomcat deployments running affected versions with EncryptInterceptor enabled using the default configuration. Environments not using EncryptInterceptor appear less exposed based on the provided description. Older 8.5 and 7 deployments require special attention because the bundle names affected ranges but only lists fixed versions for 11, 10.1, and 9. Treat as priority patching for any Tomcat systems using EncryptInterceptor, especially shared or externally reachable services. The urgency is high because exploitation is remote and unauthenticated, but scope should be validated before broad emergency action. Mitigation focus: Upgrade Tomcat 11 to 11.0.19 or later where applicable.; Upgrade Tomcat 10.1 to 10.1.53 or later where applicable.; Upgrade Tomcat 9 to 9.0.116 or later where applicable..

Prepared

Jul 11, 2026, 06:25 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.