CVE-2026-29129
Fixed in a distro release EPSS <1%CVSS 7.5
Configured cipher preference order not preserved vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.16 through 11.0.18, from 10.1.51 through 10.1.52, from 9.0.114 through 9.0.115. Users are recommended to upgrade to version 11.0.20, 10.1.53 or 9.0.116, which fix the issue.
Products: Apache Software Foundation Apache Tomcat
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 9.0.116 |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 10.1.53 |
| Maven | org.apache.tomcat.embed:tomcat-embed-core | 11.0.20 |
| Maven | org.apache.tomcat:tomcat | 9.0.116 |
| Maven | org.apache.tomcat:tomcat | 10.1.53 |
| Maven | org.apache.tomcat:tomcat | 11.0.20 |
| Maven | org.apache.tomcat:tomcat-coyote | 9.0.116 |
| Maven | org.apache.tomcat:tomcat-coyote | 10.1.53 |
| Maven | org.apache.tomcat:tomcat-coyote | 11.0.20 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | camunda-8.8 | 8.8.22-r0 |
| Chainguard | camunda-zeebe-8.6 | 8.6.39-r0 |
| Chainguard | camunda-zeebe-8.7 | 8.7.27-r0 |
| Chainguard | camunda-zeebe-8.8 | 8.8.22-r0 |
| Chainguard | kayenta-2025.0 | 2025.0.8-r11 |
| Chainguard | kayenta-2025.1 | 2025.1.6-r9 |
| Chainguard | kayenta-2025.2 | 2025.2.4-r5 |
| Chainguard | kayenta-2025.4 | 2025.4.3-r6 |
| Chainguard | kayenta-2026.0 | 2026.0.2-r6 |
| Chainguard | kayenta-fips-2025.0 | 2025.0.8-r13 |
| Chainguard | kayenta-fips-2025.1 | 2025.1.6-r10 |
| Chainguard | kayenta-fips-2025.2 | 2025.2.4-r6 |
| Chainguard | kayenta-fips-2025.4 | 2025.4.3-r7 |
| Chainguard | kayenta-fips-2026.0 | 2026.0.2-r7 |
| Chainguard | nacos | 3.2.0-r6 |
| Chainguard | nacos-docker | 3.2.0-r2 |
| Chainguard | ontop | 5.5.0-r8 |
| Chainguard | ontop-fips | 5.5.0-r4 |
| Chainguard | thingsboard-tb-mqtt-transport | 4.3.1.1-r11 |
| Chainguard | thingsboard-tb-node | 4.3.1.1-r11 |
| Debian:12 | tomcat10 | 10.1.55-1~deb12u1 |
| Debian:12 | tomcat9 | 9.0.70-2 |
| Debian:13 | tomcat10 | 10.1.55-1~deb13u1 |
| Debian:13 | tomcat11 | 11.0.22-1~deb13u1 |
| Debian:13 | tomcat9 | 9.0.70-2 |
| Debian:14 | tomcat10 | 10.1.54-1 |
| Debian:14 | tomcat11 | 11.0.21-1 |
| Debian:14 | tomcat9 | 9.0.70-2 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | tomcat | 9.0.117-150200.105.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | tomcat | 9.0.117-150200.105.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | tomcat | 9.0.117-150200.105.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | tomcat10 | 10.1.54-150200.5.64.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | tomcat | 9.0.117-150200.105.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | tomcat10 | 10.1.54-150200.5.64.1 |
| SUSE:Linux Enterprise Module for Web and Scripting 15 SP7 | tomcat | 9.0.117-150200.105.1 |
| SUSE:Linux Enterprise Module for Web and Scripting 15 SP7 | tomcat10 | 10.1.54-150200.5.64.1 |
| SUSE:Linux Enterprise Module for Web and Scripting 15 SP7 | tomcat11 | 11.0.21-150600.13.18.1 |
| SUSE:Linux Enterprise Server 12 SP5-LTSS | tomcat | 9.0.117-3.163.2 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | tomcat | 9.0.117-150200.105.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | tomcat | 9.0.117-150200.105.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | tomcat10 | 10.1.54-150200.5.64.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | tomcat | 9.0.117-150200.105.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | tomcat10 | 10.1.54-150200.5.64.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | tomcat11 | 11.0.21-150600.13.18.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | tomcat | 9.0.117-3.163.2 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | tomcat | 9.0.117-150200.105.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | tomcat | 9.0.117-150200.105.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | tomcat10 | 10.1.54-150200.5.64.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | tomcat | 9.0.117-150200.105.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | tomcat10 | 10.1.54-150200.5.64.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | tomcat11 | 11.0.21-150600.13.18.1 |
| Ubuntu:26.04:LTS | tomcat11 | no fix |
| Ubuntu:26.04:LTS | tomcat9 | no fix |
| Wolfi | thingsboard-tb-mqtt-transport | 4.3.1.1-r11 |
| Wolfi | thingsboard-tb-node | 4.3.1.1-r11 |
| openSUSE:Leap 16.0 | tomcat | 9.0.117-160000.1.1 |
| openSUSE:Leap 16.0 | tomcat10 | 10.1.54-160000.1.1 |
| openSUSE:Leap 16.0 | tomcat11 | 11.0.21-160000.1.1 |
| openSUSE:Tumbleweed | tomcat | 9.0.117-1.1 |
| openSUSE:Tumbleweed | tomcat10 | 10.1.54-1.1 |
| openSUSE:Tumbleweed | tomcat11 | 11.0.21-1.1 |