CVE-2026-34486
EUVD-2026-2105609.04.2026, 20:16
Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| apache | tomcat | 9.0.116 |
| apache | tomcat | 10.1.53 |
| apache | tomcat | 11.0.20 |
| redhat | jboss_web_server | 7.0.0 |
| redhat | enterprise_linux | 8.0 |
| redhat | enterprise_linux | 9.0 |
| redhat | enterprise_linux | 10.0 |
| redhat | enterprise_linux_els | 7.0 |
| redhat | enterprise_linux_eus | 10.0 |
| redhat | enterprise_linux_tus | 8.8 |
| redhat | enterprise_linux_update_services_for_sap_solutions | 8.8 |
| redhat | enterprise_linux_update_services_for_sap_solutions | 9.2 |
| redhat | enterprise_linux_update_services_for_sap_solutions | 9.4 |
| redhat | enterprise_linux_update_services_for_sap_solutions | 9.6 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | 1:10.1.49-3.el10_2 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 10 | 1:9.0.117-2.el10_2 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | 1:10.1.36-2.el10_0 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | 1:9.0.87-6.el10_0 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | 0:7.0.76-18.el7_9 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 8 | 1:9.0.87-2.el8_10 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | 1:9.0.87-2.el8_8 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | 1:9.0.87-2.el8_8 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 9 | 1:9.0.117-2.el9_8 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | 1:9.0.87-2.el9_2 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | 1:9.0.87-2.el9_4 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | 1:9.0.87-4.el9_6 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat JBoss Web Server 7.0 on RHEL 10 | 0:11.0.21-5.redhat_00004.1.el10jws ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat JBoss Web Server 7.0 on RHEL 8 | 0:11.0.21-5.redhat_00004.1.el8jws ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat JBoss Web Server 7.0 on RHEL 9 | 0:11.0.21-5.redhat_00004.1.el9jws ≤ 𝑥 < * | ADP |
Debian Releases
Debian Product | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| tomcat10 |
| ||||||||||||
| tomcat11 |
| ||||||||||||
| tomcat9 |
|
Ubuntu Releases
Ubuntu Product | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| tomcat6 |
| ||||||||||||||
| tomcat7 |
| ||||||||||||||
| tomcat10 |
| ||||||||||||||
| tomcat11 |
| ||||||||||||||
| tomcat8 |
| ||||||||||||||
| tomcat9 |
|
openSUSE / SLES Releases
openSUSE Product | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| tomcat |
| ||||||||||||||||
| tomcat-admin-webapps |
| ||||||||||||||||
| tomcat-el-3_0-api |
| ||||||||||||||||
| tomcat-jsp-2_3-api |
| ||||||||||||||||
| tomcat-lib |
| ||||||||||||||||
| tomcat-servlet-4_0-api |
| ||||||||||||||||
| tomcat-webapps |
| ||||||||||||||||
| tomcat10 |
| ||||||||||||||||
| tomcat10-admin-webapps |
| ||||||||||||||||
| tomcat10-el-5_0-api |
| ||||||||||||||||
| tomcat10-jsp-3_1-api |
| ||||||||||||||||
| tomcat10-lib |
| ||||||||||||||||
| tomcat10-servlet-6_0-api |
| ||||||||||||||||
| tomcat10-webapps |
| ||||||||||||||||
| tomcat11 |
| ||||||||||||||||
| tomcat11-admin-webapps |
| ||||||||||||||||
| tomcat11-el-6_0-api |
| ||||||||||||||||
| tomcat11-jsp-4_0-api |
| ||||||||||||||||
| tomcat11-lib |
| ||||||||||||||||
| tomcat11-servlet-6_1-api |
| ||||||||||||||||
| tomcat11-webapps |
|
Red Hat Enterprise Linux Releases
Red Hat Product | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| tomcat |
| ||||||||
| tomcat-admin-webapps |
| ||||||||
| tomcat-docs-webapp |
| ||||||||
| tomcat-el-3.0-api |
| ||||||||
| tomcat-jsp-2.3-api |
| ||||||||
| tomcat-lib |
| ||||||||
| tomcat-servlet-4.0-api |
| ||||||||
| tomcat-webapps |
|
Common Weakness Enumeration
- CWE-311 - Missing Encryption of Sensitive DataThe software does not encrypt sensitive or critical information before storage or transmission.
- CWE-807 - Reliance on Untrusted Inputs in a Security DecisionThe application uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.
Vulnerability Media Exposure
References