Skip to main content

Apache Tomcat CVE-2026-34486

| EUVDEUVD-2026-21056 HIGH
Missing Encryption of Sensitive Data (CWE-311)
2026-04-09 apache GHSA-69r9-qgr7-g2wj
Apache Information Disclosure Tomcat Apache Tomcat
7.5
CVSS 3.1 · Vendor: apache
Share

Severity by source

Vendor (apache) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vuln.today AI
7.5 MEDIUM

Network-accessible cluster traffic interception requires no privileges or user interaction; only confidentiality is impacted as plaintext session data is exposed.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

13
Analysis Updated
Aug 06, 2026 - 22:56 vuln.today
v4 (cvss_changed)
Analysis Updated
Aug 06, 2026 - 22:55 vuln.today
v3 (cvss_changed)
Severity Changed
Aug 06, 2026 - 22:22 NVD
CRITICAL HIGH
CVSS changed
Aug 06, 2026 - 22:22 NVD
9.8 (CRITICAL) 7.5 (HIGH)
Analysis Updated
Aug 05, 2026 - 14:28 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Aug 05, 2026 - 14:22 vuln.today
cvss_changed
Severity Changed
Aug 05, 2026 - 14:22 NVD
HIGH CRITICAL
CVSS changed
Aug 05, 2026 - 14:22 NVD
7.5 (HIGH) 9.8 (CRITICAL)
Added to CISA KEV
Aug 04, 2026 - 17:16 CISA
Patch released
Apr 11, 2026 - 02:30 nvd
Patch available
EUVD ID Assigned
Apr 09, 2026 - 20:15 euvd
EUVD-2026-21056
Analysis Generated
Apr 09, 2026 - 20:15 vuln.today
CVE Published
Apr 09, 2026 - 19:35 nvd
HIGH 7.5

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 378 maven packages depend on org.apache.tomcat.embed:tomcat-embed-core (10 direct, 368 indirect)
  • 2 maven packages depend on org.apache.tomcat:tomcat-catalina (2 direct, 0 indirect)
  • 5 maven packages depend on org.apache.tomcat:tomcat-tribes (2 direct, 3 indirect)

Ecosystem-wide dependent count for version 11.0.20 and other introduced versions.

DescriptionCVE.org

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.

This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

AnalysisAI

Missing encryption of cluster replication traffic in Apache Tomcat 11.0.20, 10.1.53, and 9.0.116 exposes sensitive session data to network-positioned attackers because the EncryptInterceptor - the clustering security control - can be bypassed due to a regression introduced by the fix for CVE-2026-29146. Listed in CISA KEV as actively exploited with a publicly available exploit, though EPSS sits at just 0.01% (1st percentile), indicating targeted rather than widespread automated exploitation. The confidentiality impact is rated High with no integrity or availability impact, consistent with CWE-311 (Missing Encryption of Sensitive Data).

Technical ContextAI

Apache Tomcat's clustering subsystem uses an EncryptInterceptor to encrypt session replication and other state data transmitted between cluster nodes over the network. CWE-311 (Missing Encryption of Sensitive Data) is the root cause class: the security control exists but is ineffective due to a bypass path. The regression was introduced specifically by the patch for CVE-2026-29146, meaning only deployments that applied that prior fix - landing on exactly versions 11.0.20, 10.1.53, or 9.0.116 - are affected. CPE cpe:2.3:a:apache_software_foundation:apache_tomcat covers the affected product. The bypass allows cluster traffic that should be encrypted in transit to travel as plaintext, exposing whatever sensitive application data is replicated across nodes.

RemediationAI

Upgrade to Apache Tomcat 11.0.21, 10.1.54, or 9.0.117 as applicable to the deployed branch; these versions are confirmed by the Apache Software Foundation as the corrective releases per the advisory at https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly. Red Hat customers should consult RHSA-2026:36787 through RHSA-2026:36790 and RHSA-2026:36876 through RHSA-2026:36877 at https://access.redhat.com/errata/ for platform-specific errata. If immediate patching is not feasible in clustered deployments, isolate cluster replication traffic to a dedicated network segment with strict ACLs permitting only known cluster node IPs - this reduces the interception surface but does not eliminate the plaintext exposure. Disabling clustering entirely removes the vulnerability but sacrifices session replication and high-availability capabilities. Note that the vulnerability is only exploitable in clustered Tomcat deployments with EncryptInterceptor configured; single-instance deployments require no action.

More in Tomcat

View all
CVE-2017-12617 HIGH POC
8.1 Oct 04

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
CVE-2020-1938 CRITICAL POC
9.8 Feb 24

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Rate
CVE-2023-47246 CRITICAL POC
9.8 Nov 10

In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a f
CVE-2016-8735 CRITICAL POC
9.8 Apr 06

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
CVE-2017-12615 HIGH POC
8.1 Sep 19

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. Rated high severity (CVSS 8.1), this

CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2014-0050 HIGH POC
7.5 Apr 01

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products,
CVE-2020-13935 HIGH POC
7.5 Jul 14

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to
CVE-2017-12616 HIGH
7.5 Sep 19

When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or

CVE-2020-9484 HIGH POC
7.0 May 20

When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a)
CVE-2014-0227 MEDIUM
6.4 Feb 16

java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and
CVE-2021-33037 MEDIUM
5.3 Jul 12

Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-enco

Same weakness CWE-311 – Missing Encryption of Sensitive Data

View all
CVE-2017-8221 HIGH POC
7.5
CVE-2019-11367 CRITICAL POC
9.8
CVE-2025-69969 CRITICAL POC
9.6
CVE-2019-18800 HIGH POC
8.8
CVE-2017-6445 HIGH POC
8.1
CVE-2019-5448 HIGH POC
8.1
CVE-2018-5261 HIGH POC
8.1
CVE-2022-26281 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected

Share

CVE-2026-34486 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy