← Back

CVE-2026-34486

nvd nistnuclei
Published: Apr 9, 2026Modified: Aug 10, 2026CISA KEV

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Exploitability: 3.9 / Impact: 3.6
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

Affected (14)

Apache
1 product
Tomcat
Redhat
6 products
Enterprise Linux
Enterprise Linux Els
Enterprise Linux Eus
Enterprise Linux Tus
Enterprise Linux Update Services For Sap Solutions
Jboss Web Server
Configuration A
3 vulnerable
Vulnerable SoftwareAffected Versions
Apache
Tomcat
Version 10.1.53
Tomcat
Version 11.0.20
Tomcat
Version 9.0.116
Configuration B
11 vulnerable
Vulnerable SoftwareAffected Versions
Redhat
Enterprise Linux
Version 10.0
Enterprise Linux
Version 8.0
Enterprise Linux
Version 9.0
Enterprise Linux Els
Version 7.0
Enterprise Linux Eus
Version 10.0
Enterprise Linux Tus
Version 8.8
Redhat
Enterprise Linux Update Services For Sap Solutions
Version 8.8
Enterprise Linux Update Services For Sap Solutions
Version 9.2
Enterprise Linux Update Services For Sap Solutions
Version 9.4
Enterprise Linux Update Services For Sap Solutions
Version 9.6
Jboss Web Server
Version 7.0.0

Related CWEs

CWE-311
Missing Encryption of Sensitive Data
The product does not encrypt sensitive or critical information before storage or transmission.
CWE-807
Reliance on Untrusted Inputs in a Security Decision
The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.

References (21)

Source: security@apache.org
Mailing ListVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
MitigationThird Party Advisory
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Third Party Advisory
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Third Party Advisory
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Third Party Advisory
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Third Party Advisory
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Third Party Advisory
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Third Party Advisory
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Third Party Advisory
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Third Party Advisory
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Third Party Advisory
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Third Party Advisory
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Third Party Advisory
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Third Party Advisory
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Third Party Advisory
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Third Party Advisory
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Issue TrackingThird Party Advisory
Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Third Party Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Third Party Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
US Government Resource

Timeline

No history available yet.