Patchwire CVEs, their patch status, and feeds to follow them

CVE-2026-34486

Fixed in a distro release ExploitedEPSS 99%CVSS 7.5

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

Published 2026-04-09 · In CISA KEV since 2026-08-04 · CVE record · OSV

Products: Apache Software Foundation Apache Tomcat, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat JBoss Web Server 7.0.0, Red Hat JBoss Web Server 7.0 on RHEL 10, Red Hat JBoss Web Server 7.0 on RHEL 8, Red Hat JBoss Web Server 7.0 on RHEL 9, Red Hat Enterprise Linux 6, Red Hat JBoss Web Server 5, Red Hat JBoss Web Server 6

Fixed upstream

EcosystemPackageFixed in
Mavenorg.apache.tomcat:tomcat11.0.21
Mavenorg.apache.tomcat:tomcat10.1.54
Mavenorg.apache.tomcat:tomcat9.0.117
Mavenorg.apache.tomcat:tomcat-tribes11.0.21
Mavenorg.apache.tomcat:tomcat-tribes10.1.54
Mavenorg.apache.tomcat:tomcat-tribes9.0.117

Distro releases

ReleasePackageFixed in
AlmaLinux 10tomcat1:10.1.49-3.el10_2.alma.1
AlmaLinux 10tomcat-admin-webapps1:10.1.49-3.el10_2.alma.1
AlmaLinux 10tomcat-docs-webapp1:10.1.49-3.el10_2.alma.1
AlmaLinux 10tomcat-el-5.0-api1:10.1.49-3.el10_2.alma.1
AlmaLinux 10tomcat-jsp-3.1-api1:10.1.49-3.el10_2.alma.1
AlmaLinux 10tomcat-lib1:10.1.49-3.el10_2.alma.1
AlmaLinux 10tomcat-servlet-6.0-api1:10.1.49-3.el10_2.alma.1
AlmaLinux 10tomcat-webapps1:10.1.49-3.el10_2.alma.1
AlmaLinux 10tomcat91:9.0.117-2.el10_2.alma.1
AlmaLinux 10tomcat9-admin-webapps1:9.0.117-2.el10_2.alma.1
AlmaLinux 10tomcat9-docs-webapp1:9.0.117-2.el10_2.alma.1
AlmaLinux 10tomcat9-el-3.0-api1:9.0.117-2.el10_2.alma.1
AlmaLinux 10tomcat9-jsp-2.3-api1:9.0.117-2.el10_2.alma.1
AlmaLinux 10tomcat9-lib1:9.0.117-2.el10_2.alma.1
AlmaLinux 10tomcat9-servlet-4.0-api1:9.0.117-2.el10_2.alma.1
AlmaLinux 10tomcat9-webapps1:9.0.117-2.el10_2.alma.1
AlmaLinux 8tomcat1:9.0.87-2.el8_10
AlmaLinux 8tomcat-admin-webapps1:9.0.87-2.el8_10
AlmaLinux 8tomcat-docs-webapp1:9.0.87-2.el8_10
AlmaLinux 8tomcat-el-3.0-api1:9.0.87-2.el8_10
AlmaLinux 8tomcat-jsp-2.3-api1:9.0.87-2.el8_10
AlmaLinux 8tomcat-lib1:9.0.87-2.el8_10
AlmaLinux 8tomcat-servlet-4.0-api1:9.0.87-2.el8_10
AlmaLinux 8tomcat-webapps1:9.0.87-2.el8_10
AlmaLinux 9tomcat1:9.0.117-2.el9_8
AlmaLinux 9tomcat-admin-webapps1:9.0.117-2.el9_8
AlmaLinux 9tomcat-docs-webapp1:9.0.117-2.el9_8
AlmaLinux 9tomcat-el-3.0-api1:9.0.117-2.el9_8
AlmaLinux 9tomcat-jsp-2.3-api1:9.0.117-2.el9_8
AlmaLinux 9tomcat-lib1:9.0.117-2.el9_8
AlmaLinux 9tomcat-servlet-4.0-api1:9.0.117-2.el9_8
AlmaLinux 9tomcat-webapps1:9.0.117-2.el9_8
Chainguardnacos3.2.0-r6
Chainguardontop5.5.0-r8
Chainguardontop-fips5.5.0-r4
Red Hat Enterprise Linux 10.2tomcat1:10.1.49-3.el10_2
Red Hat Enterprise Linux 10.2tomcat-admin-webapps1:10.1.49-3.el10_2
Red Hat Enterprise Linux 10.2tomcat-docs-webapp1:10.1.49-3.el10_2
Red Hat Enterprise Linux 10.2tomcat-el-5.0-api1:10.1.49-3.el10_2
Red Hat Enterprise Linux 10.2tomcat-jsp-3.1-api1:10.1.49-3.el10_2
Red Hat Enterprise Linux 10.2tomcat-lib1:10.1.49-3.el10_2
Red Hat Enterprise Linux 10.2tomcat-servlet-6.0-api1:10.1.49-3.el10_2
Red Hat Enterprise Linux 10.2tomcat-webapps1:10.1.49-3.el10_2
Red Hat Enterprise Linux 10.2tomcat91:9.0.117-2.el10_2
Red Hat Enterprise Linux 10.2tomcat9-admin-webapps1:9.0.117-2.el10_2
Red Hat Enterprise Linux 10.2tomcat9-docs-webapp1:9.0.117-2.el10_2
Red Hat Enterprise Linux 10.2tomcat9-el-3.0-api1:9.0.117-2.el10_2
Red Hat Enterprise Linux 10.2tomcat9-jsp-2.3-api1:9.0.117-2.el10_2
Red Hat Enterprise Linux 10.2tomcat9-lib1:9.0.117-2.el10_2
Red Hat Enterprise Linux 10.2tomcat9-servlet-4.0-api1:9.0.117-2.el10_2
Red Hat Enterprise Linux 10.2tomcat9-webapps1:9.0.117-2.el10_2
Red Hat Enterprise Linux 8tomcat1:9.0.87-2.el8_10
Red Hat Enterprise Linux 8tomcat-admin-webapps1:9.0.87-2.el8_10
Red Hat Enterprise Linux 8tomcat-docs-webapp1:9.0.87-2.el8_10
Red Hat Enterprise Linux 8tomcat-el-3.0-api1:9.0.87-2.el8_10
Red Hat Enterprise Linux 8tomcat-jsp-2.3-api1:9.0.87-2.el8_10
Red Hat Enterprise Linux 8tomcat-lib1:9.0.87-2.el8_10
Red Hat Enterprise Linux 8tomcat-servlet-4.0-api1:9.0.87-2.el8_10
Red Hat Enterprise Linux 8tomcat-webapps1:9.0.87-2.el8_10
Red Hat Enterprise Linux 9tomcat1:9.0.117-2.el9_8
Red Hat Enterprise Linux 9tomcat-admin-webapps1:9.0.117-2.el9_8
Red Hat Enterprise Linux 9tomcat-docs-webapp1:9.0.117-2.el9_8
Red Hat Enterprise Linux 9tomcat-el-3.0-api1:9.0.117-2.el9_8
Red Hat Enterprise Linux 9tomcat-jsp-2.3-api1:9.0.117-2.el9_8
Red Hat Enterprise Linux 9tomcat-lib1:9.0.117-2.el9_8
Red Hat Enterprise Linux 9tomcat-servlet-4.0-api1:9.0.117-2.el9_8
Red Hat Enterprise Linux 9tomcat-webapps1:9.0.117-2.el9_8
Red Hat Enterprise Linux eus 10.0tomcat1:10.1.36-2.el10_0
Red Hat Enterprise Linux eus 10.0tomcat-admin-webapps1:10.1.36-2.el10_0
Red Hat Enterprise Linux eus 10.0tomcat-docs-webapp1:10.1.36-2.el10_0
Red Hat Enterprise Linux eus 10.0tomcat-el-5.0-api1:10.1.36-2.el10_0
Red Hat Enterprise Linux eus 10.0tomcat-jsp-3.1-api1:10.1.36-2.el10_0
Red Hat Enterprise Linux eus 10.0tomcat-lib1:10.1.36-2.el10_0
Red Hat Enterprise Linux eus 10.0tomcat-servlet-6.0-api1:10.1.36-2.el10_0
Red Hat Enterprise Linux eus 10.0tomcat-webapps1:10.1.36-2.el10_0
Red Hat Enterprise Linux eus 10.0tomcat91:9.0.87-6.el10_0
Red Hat Enterprise Linux eus 10.0tomcat9-admin-webapps1:9.0.87-6.el10_0
Red Hat Enterprise Linux eus 10.0tomcat9-docs-webapp1:9.0.87-6.el10_0
Red Hat Enterprise Linux eus 10.0tomcat9-el-3.0-api1:9.0.87-6.el10_0
Red Hat Enterprise Linux eus 10.0tomcat9-jsp-2.3-api1:9.0.87-6.el10_0
Red Hat Enterprise Linux eus 10.0tomcat9-lib1:9.0.87-6.el10_0
Red Hat Enterprise Linux eus 10.0tomcat9-servlet-4.0-api1:9.0.87-6.el10_0
Red Hat Enterprise Linux eus 10.0tomcat9-webapps1:9.0.87-6.el10_0
Red Hat jboss enterprise web server 7.0jws7-tomcat0:11.0.21-5.redhat_00004.1.el10jws
Red Hat jboss enterprise web server 7.0jws7-tomcat0:11.0.21-5.redhat_00004.1.el9jws
Red Hat jboss enterprise web server 7.0jws7-tomcat0:11.0.21-5.redhat_00004.1.el8jws
Red Hat jboss enterprise web server 7.0jws7-tomcat-admin-webapps0:11.0.21-5.redhat_00004.1.el9jws
Red Hat jboss enterprise web server 7.0jws7-tomcat-admin-webapps0:11.0.21-5.redhat_00004.1.el10jws
Red Hat jboss enterprise web server 7.0jws7-tomcat-admin-webapps0:11.0.21-5.redhat_00004.1.el8jws
Red Hat jboss enterprise web server 7.0jws7-tomcat-docs-webapp0:11.0.21-5.redhat_00004.1.el10jws
Red Hat jboss enterprise web server 7.0jws7-tomcat-docs-webapp0:11.0.21-5.redhat_00004.1.el8jws
Red Hat jboss enterprise web server 7.0jws7-tomcat-docs-webapp0:11.0.21-5.redhat_00004.1.el9jws
Red Hat jboss enterprise web server 7.0jws7-tomcat-el-5.0-api0:11.0.21-5.redhat_00004.1.el8jws
Red Hat jboss enterprise web server 7.0jws7-tomcat-el-5.0-api0:11.0.21-5.redhat_00004.1.el10jws
Red Hat jboss enterprise web server 7.0jws7-tomcat-el-5.0-api0:11.0.21-5.redhat_00004.1.el9jws
Red Hat jboss enterprise web server 7.0jws7-tomcat-javadoc0:11.0.21-5.redhat_00004.1.el9jws
Red Hat jboss enterprise web server 7.0jws7-tomcat-javadoc0:11.0.21-5.redhat_00004.1.el8jws
Red Hat jboss enterprise web server 7.0jws7-tomcat-javadoc0:11.0.21-5.redhat_00004.1.el10jws
Red Hat jboss enterprise web server 7.0jws7-tomcat-jsp-3.1-api0:11.0.21-5.redhat_00004.1.el10jws
Red Hat jboss enterprise web server 7.0jws7-tomcat-jsp-3.1-api0:11.0.21-5.redhat_00004.1.el9jws
Red Hat jboss enterprise web server 7.0jws7-tomcat-jsp-3.1-api0:11.0.21-5.redhat_00004.1.el8jws
Red Hat jboss enterprise web server 7.0jws7-tomcat-lib0:11.0.21-5.redhat_00004.1.el10jws
Red Hat jboss enterprise web server 7.0jws7-tomcat-lib0:11.0.21-5.redhat_00004.1.el9jws
Red Hat jboss enterprise web server 7.0jws7-tomcat-lib0:11.0.21-5.redhat_00004.1.el8jws
Red Hat jboss enterprise web server 7.0jws7-tomcat-selinux0:11.0.21-5.redhat_00004.1.el8jws
Red Hat jboss enterprise web server 7.0jws7-tomcat-selinux0:11.0.21-5.redhat_00004.1.el9jws
Red Hat jboss enterprise web server 7.0jws7-tomcat-selinux0:11.0.21-5.redhat_00004.1.el10jws
Red Hat jboss enterprise web server 7.0jws7-tomcat-servlet-6.0-api0:11.0.21-5.redhat_00004.1.el10jws
Red Hat jboss enterprise web server 7.0jws7-tomcat-servlet-6.0-api0:11.0.21-5.redhat_00004.1.el9jws
Red Hat jboss enterprise web server 7.0jws7-tomcat-servlet-6.0-api0:11.0.21-5.redhat_00004.1.el8jws
Red Hat jboss enterprise web server 7.0jws7-tomcat-webapps0:11.0.21-5.redhat_00004.1.el8jws
Red Hat jboss enterprise web server 7.0jws7-tomcat-webapps0:11.0.21-5.redhat_00004.1.el10jws
Red Hat jboss enterprise web server 7.0jws7-tomcat-webapps0:11.0.21-5.redhat_00004.1.el9jws
Red Hat rhel e4s 8.8tomcat1:9.0.87-2.el8_8
Red Hat rhel e4s 8.8tomcat-admin-webapps1:9.0.87-2.el8_8
Red Hat rhel e4s 8.8tomcat-docs-webapp1:9.0.87-2.el8_8
Red Hat rhel e4s 8.8tomcat-el-3.0-api1:9.0.87-2.el8_8
Red Hat rhel e4s 8.8tomcat-jsp-2.3-api1:9.0.87-2.el8_8
Red Hat rhel e4s 8.8tomcat-lib1:9.0.87-2.el8_8
Red Hat rhel e4s 8.8tomcat-servlet-4.0-api1:9.0.87-2.el8_8
Red Hat rhel e4s 8.8tomcat-webapps1:9.0.87-2.el8_8
Red Hat rhel e4s 9.2tomcat1:9.0.87-2.el9_2
Red Hat rhel e4s 9.2tomcat-admin-webapps1:9.0.87-2.el9_2
Red Hat rhel e4s 9.2tomcat-docs-webapp1:9.0.87-2.el9_2
Red Hat rhel e4s 9.2tomcat-el-3.0-api1:9.0.87-2.el9_2
Red Hat rhel e4s 9.2tomcat-jsp-2.3-api1:9.0.87-2.el9_2
Red Hat rhel e4s 9.2tomcat-lib1:9.0.87-2.el9_2
Red Hat rhel e4s 9.2tomcat-servlet-4.0-api1:9.0.87-2.el9_2
Red Hat rhel e4s 9.2tomcat-webapps1:9.0.87-2.el9_2
Red Hat rhel e4s 9.4tomcat1:9.0.87-2.el9_4
Red Hat rhel e4s 9.4tomcat-admin-webapps1:9.0.87-2.el9_4
Red Hat rhel e4s 9.4tomcat-docs-webapp1:9.0.87-2.el9_4
Red Hat rhel e4s 9.4tomcat-el-3.0-api1:9.0.87-2.el9_4
Red Hat rhel e4s 9.4tomcat-jsp-2.3-api1:9.0.87-2.el9_4
Red Hat rhel e4s 9.4tomcat-lib1:9.0.87-2.el9_4
Red Hat rhel e4s 9.4tomcat-servlet-4.0-api1:9.0.87-2.el9_4
Red Hat rhel e4s 9.4tomcat-webapps1:9.0.87-2.el9_4
Red Hat rhel els 7tomcat0:7.0.76-18.el7_9
Red Hat rhel els 7tomcat-admin-webapps0:7.0.76-18.el7_9
Red Hat rhel els 7tomcat-docs-webapp0:7.0.76-18.el7_9
Red Hat rhel els 7tomcat-el-2.2-api0:7.0.76-18.el7_9
Red Hat rhel els 7tomcat-javadoc0:7.0.76-18.el7_9
Red Hat rhel els 7tomcat-jsp-2.2-api0:7.0.76-18.el7_9
Red Hat rhel els 7tomcat-jsvc0:7.0.76-18.el7_9
Red Hat rhel els 7tomcat-lib0:7.0.76-18.el7_9
Red Hat rhel els 7tomcat-servlet-3.0-api0:7.0.76-18.el7_9
Red Hat rhel els 7tomcat-webapps0:7.0.76-18.el7_9
Red Hat rhel eus 9.6tomcat1:9.0.87-4.el9_6
Red Hat rhel eus 9.6tomcat-admin-webapps1:9.0.87-4.el9_6
Red Hat rhel eus 9.6tomcat-docs-webapp1:9.0.87-4.el9_6
Red Hat rhel eus 9.6tomcat-el-3.0-api1:9.0.87-4.el9_6
Red Hat rhel eus 9.6tomcat-jsp-2.3-api1:9.0.87-4.el9_6
Red Hat rhel eus 9.6tomcat-lib1:9.0.87-4.el9_6
Red Hat rhel eus 9.6tomcat-servlet-4.0-api1:9.0.87-4.el9_6
Red Hat rhel eus 9.6tomcat-webapps1:9.0.87-4.el9_6
Red Hat rhel tus 8.8tomcat1:9.0.87-2.el8_8
Red Hat rhel tus 8.8tomcat-admin-webapps1:9.0.87-2.el8_8
Red Hat rhel tus 8.8tomcat-docs-webapp1:9.0.87-2.el8_8
Red Hat rhel tus 8.8tomcat-el-3.0-api1:9.0.87-2.el8_8
Red Hat rhel tus 8.8tomcat-jsp-2.3-api1:9.0.87-2.el8_8
Red Hat rhel tus 8.8tomcat-lib1:9.0.87-2.el8_8
Red Hat rhel tus 8.8tomcat-servlet-4.0-api1:9.0.87-2.el8_8
Red Hat rhel tus 8.8tomcat-webapps1:9.0.87-2.el8_8
Rocky Linux 10tomcat1:10.1.49-3.el10_2
Rocky Linux 10tomcat91:9.0.117-2.el10_2
Rocky Linux 8tomcat1:9.0.87-2.el8_10
Rocky Linux 9tomcat1:9.0.117-2.el9_8
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOStomcat9.0.117-150200.105.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSStomcat9.0.117-150200.105.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOStomcat9.0.117-150200.105.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOStomcat1010.1.54-150200.5.64.1
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSStomcat9.0.117-150200.105.1
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSStomcat1010.1.54-150200.5.64.1
SUSE Linux Enterprise Module for Web and Scripting 15 SP7tomcat9.0.117-150200.105.1
SUSE Linux Enterprise Module for Web and Scripting 15 SP7tomcat1010.1.54-150200.5.64.1
SUSE Linux Enterprise Module for Web and Scripting 15 SP7tomcat1111.0.21-150600.13.18.1
SUSE Linux Enterprise Server 12 SP5-LTSStomcat9.0.117-3.163.2
SUSE Linux Enterprise Server 15 SP4-LTSStomcat9.0.117-150200.105.1
SUSE Linux Enterprise Server 15 SP5-LTSStomcat9.0.117-150200.105.1
SUSE Linux Enterprise Server 15 SP5-LTSStomcat1010.1.54-150200.5.64.1
SUSE Linux Enterprise Server 15 SP6-LTSStomcat9.0.117-150200.105.1
SUSE Linux Enterprise Server 15 SP6-LTSStomcat1010.1.54-150200.5.64.1
SUSE Linux Enterprise Server 15 SP6-LTSStomcat1111.0.21-150600.13.18.1
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5tomcat9.0.117-3.163.2
SUSE Linux Enterprise Server for SAP Applications 15 SP4tomcat9.0.117-150200.105.1
SUSE Linux Enterprise Server for SAP Applications 15 SP5tomcat9.0.117-150200.105.1
SUSE Linux Enterprise Server for SAP Applications 15 SP5tomcat1010.1.54-150200.5.64.1
SUSE Linux Enterprise Server for SAP Applications 15 SP6tomcat9.0.117-150200.105.1
SUSE Linux Enterprise Server for SAP Applications 15 SP6tomcat1010.1.54-150200.5.64.1
SUSE Linux Enterprise Server for SAP Applications 15 SP6tomcat1111.0.21-150600.13.18.1
Ubuntu Pro 18.04 LTStomcat8no fix
openSUSE Leap 16.0tomcat9.0.117-160000.1.1
openSUSE Leap 16.0tomcat1010.1.54-160000.1.1
openSUSE Leap 16.0tomcat1111.0.21-160000.1.1
openSUSE Tumbleweedtomcat9.0.117-1.1
openSUSE Tumbleweedtomcat1010.1.54-1.1
openSUSE Tumbleweedtomcat1111.0.21-1.1