CVE catalog
CVE-2026-34486
Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53
- Severity
- High · CVSS 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Published
- Source
- [NVD] · [CVE record]
- Exploitation
- CISA Known Exploited Vulnerabilities
- EPSS
- 98.50% · Oct 25, 2026
Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | tomcat9 | sid | 9.0.122-1 | not affected |
| Debian | tomcat9 | forky | 9.0.122-1 | not affected |
| Debian | tomcat9 | trixie | 9.0.95-1 | not affected |
| Debian | tomcat9 | bookworm | 9.0.70-2 | not affected |
| Debian | tomcat10 | sid | 10.1.60-1 | not affected |
| Debian | tomcat10 | forky | 10.1.60-1 | not affected |
| Debian | tomcat10 | trixie | 10.1.55-1~deb13u1 | not affected |
| Debian | tomcat10 | trixie-security | 10.1.55-1~deb13u1 | not affected |
| Debian | tomcat10 | bookworm | 10.1.55-1~deb12u1 | not affected |
| Debian | tomcat10 | bookworm-security | 10.1.55-1~deb12u1 | not affected |
| Cpe | tomcat | Not reported | Not reported | unknown |
| Cpe | tomcat | Not reported | Not reported | unknown |
| Cpe | jboss_web_server | Not reported | Not reported | unknown |
| Cpe | enterprise_linux | Not reported | Not reported | unknown |
| Cpe | enterprise_linux_els | Not reported | Not reported | unknown |
| Cpe | enterprise_linux_eus | Not reported | Not reported | unknown |
| Cpe | enterprise_linux_tus | Not reported | Not reported | unknown |
| Cpe | enterprise_linux_update_services_for_sap_solutions | Not reported | Not reported | unknown |
| Ubuntu | tomcat8 | pro | 8.5.21-1ubuntu1 | vulnerable |
| Ubuntu | tomcat8 | pro | 8.5.29-1 | vulnerable |
| Ubuntu | tomcat8 | pro | 8.5.30-1 | vulnerable |
| Ubuntu | tomcat8 | pro | 8.5.30-1ubuntu1 | vulnerable |
| Ubuntu | tomcat8 | pro | 8.5.30-1ubuntu1.2 | vulnerable |
| Ubuntu | tomcat8 | pro | 8.5.30-1ubuntu1.3 | vulnerable |
| Ubuntu | tomcat8 | pro | 8.5.30-1ubuntu1.4 | vulnerable |
| Ubuntu | tomcat8 | pro | 8.5.39-1ubuntu1~18.04.1 | vulnerable |
| Ubuntu | tomcat8 | pro | 8.5.39-1ubuntu1~18.04.2 | vulnerable |
| Ubuntu | tomcat8 | pro | 8.5.39-1ubuntu1~18.04.3 | vulnerable |
| Ubuntu | tomcat8 | pro | 8.5.39-1ubuntu1~18.04.3+esm1 | vulnerable |
| Ubuntu | tomcat8 | pro | 8.5.39-1ubuntu1~18.04.3+esm2 | vulnerable |
| Ubuntu | tomcat8 | pro | 8.5.39-1ubuntu1~18.04.3+esm3 | vulnerable |
| Ubuntu | tomcat8 | pro | 8.5.39-1ubuntu1~18.04.3+esm4 | vulnerable |
| Ubuntu | tomcat8 | pro | 8.5.39-1ubuntu1~18.04.3+esm5 | vulnerable |
| Ubuntu | tomcat8 | pro | 8.5.39-1ubuntu1~18.04.3+esm6 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | tomcat9 | source | sid | Not affected | unimportant | Not reported | Not reported |
| Debian | tomcat9 | source | forky | Not affected | unimportant | Not reported | Not reported |
| Debian | tomcat9 | source | trixie | Not affected | unimportant | Not reported | Not reported |
| Debian | tomcat9 | source | bookworm | Not affected | unimportant | Not reported | Not reported |
| Debian | tomcat10 | source | sid | Not affected | unimportant | Not reported | Not reported |
| Debian | tomcat10 | source | forky | Not affected | unimportant | Not reported | Not reported |
| Debian | tomcat10 | source | trixie | Not affected | unimportant | Not reported | Not reported |
| Debian | tomcat10 | source | bookworm | Not affected | unimportant | Not reported | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [libtomcat10-embed-java]Not affected
Source package: [tomcat10]
Details (6)
10.1.55-1~deb12u1· all · bookwormNot affected
nvd · tomcat10 · debian · bookworm
10.1.55-1~deb12u1· all · bookwormNot affected
nvd · tomcat10 · debian · bookworm
10.1.40-1~bpo12+1· all · bookworm-backportsNot affected
nvd · tomcat10 · debian · bookworm
10.1.40-1~bpo12+1· all · bookworm-backportsNot affected
nvd · tomcat10 · debian · bookworm
10.1.55-1~deb12u1· all · bookworm-securityNot affected
nvd · tomcat10 · debian · bookworm
10.1.55-1~deb12u1· all · bookworm-securityNot affected
nvd · tomcat10 · debian · bookworm
- [libtomcat10-java]Not affected
Source package: [tomcat10]
Details (6)
10.1.55-1~deb12u1· all · bookwormNot affected
nvd · tomcat10 · debian · bookworm
10.1.55-1~deb12u1· all · bookwormNot affected
nvd · tomcat10 · debian · bookworm
10.1.40-1~bpo12+1· all · bookworm-backportsNot affected
nvd · tomcat10 · debian · bookworm
10.1.40-1~bpo12+1· all · bookworm-backportsNot affected
nvd · tomcat10 · debian · bookworm
10.1.55-1~deb12u1· all · bookworm-securityNot affected
nvd · tomcat10 · debian · bookworm
10.1.55-1~deb12u1· all · bookworm-securityNot affected
nvd · tomcat10 · debian · bookworm
- [libtomcat9-java]Not affected
Source package: [tomcat9]
Details (2)
9.0.70-2· all · bookwormNot affected
nvd · tomcat9 · debian · bookworm
9.0.70-2· all · bookwormNot affected
nvd · tomcat9 · debian · bookworm
- [tomcat10]Not affected
Details (6)
10.1.55-1~deb12u1· all · bookwormNot affected
nvd · tomcat10 · debian · bookworm
10.1.55-1~deb12u1· all · bookwormNot affected
nvd · tomcat10 · debian · bookworm
10.1.40-1~bpo12+1· all · bookworm-backportsNot affected
nvd · tomcat10 · debian · bookworm
10.1.40-1~bpo12+1· all · bookworm-backportsNot affected
nvd · tomcat10 · debian · bookworm
10.1.55-1~deb12u1· all · bookworm-securityNot affected
nvd · tomcat10 · debian · bookworm
10.1.55-1~deb12u1· all · bookworm-securityNot affected
nvd · tomcat10 · debian · bookworm
- [tomcat10-admin]Not affected
Source package: [tomcat10]
Details (6)
10.1.55-1~deb12u1· all · bookwormNot affected
nvd · tomcat10 · debian · bookworm
10.1.55-1~deb12u1· all · bookwormNot affected
nvd · tomcat10 · debian · bookworm
10.1.40-1~bpo12+1· all · bookworm-backportsNot affected
nvd · tomcat10 · debian · bookworm
10.1.40-1~bpo12+1· all · bookworm-backportsNot affected
nvd · tomcat10 · debian · bookworm
10.1.55-1~deb12u1· all · bookworm-securityNot affected
nvd · tomcat10 · debian · bookworm
10.1.55-1~deb12u1· all · bookworm-securityNot affected
nvd · tomcat10 · debian · bookworm
- [tomcat10-common]Not affected
Source package: [tomcat10]
Details (6)
10.1.55-1~deb12u1· all · bookwormNot affected
nvd · tomcat10 · debian · bookworm
10.1.55-1~deb12u1· all · bookwormNot affected
nvd · tomcat10 · debian · bookworm
10.1.40-1~bpo12+1· all · bookworm-backportsNot affected
nvd · tomcat10 · debian · bookworm
10.1.40-1~bpo12+1· all · bookworm-backportsNot affected
nvd · tomcat10 · debian · bookworm
10.1.55-1~deb12u1· all · bookworm-securityNot affected
nvd · tomcat10 · debian · bookworm
10.1.55-1~deb12u1· all · bookworm-securityNot affected
nvd · tomcat10 · debian · bookworm
- [tomcat10-docs]Not affected
Source package: [tomcat10]
Details (6)
10.1.55-1~deb12u1· all · bookwormNot affected
nvd · tomcat10 · debian · bookworm
10.1.55-1~deb12u1· all · bookwormNot affected
nvd · tomcat10 · debian · bookworm
10.1.40-1~bpo12+1· all · bookworm-backportsNot affected
nvd · tomcat10 · debian · bookworm
10.1.40-1~bpo12+1· all · bookworm-backportsNot affected
nvd · tomcat10 · debian · bookworm
10.1.55-1~deb12u1· all · bookworm-securityNot affected
nvd · tomcat10 · debian · bookworm
10.1.55-1~deb12u1· all · bookworm-securityNot affected
nvd · tomcat10 · debian · bookworm
- [tomcat10-examples]Not affected
Source package: [tomcat10]
Details (6)
10.1.55-1~deb12u1· all · bookwormNot affected
nvd · tomcat10 · debian · bookworm
10.1.55-1~deb12u1· all · bookwormNot affected
nvd · tomcat10 · debian · bookworm
10.1.40-1~bpo12+1· all · bookworm-backportsNot affected
nvd · tomcat10 · debian · bookworm
10.1.40-1~bpo12+1· all · bookworm-backportsNot affected
nvd · tomcat10 · debian · bookworm
10.1.55-1~deb12u1· all · bookworm-securityNot affected
nvd · tomcat10 · debian · bookworm
10.1.55-1~deb12u1· all · bookworm-securityNot affected
nvd · tomcat10 · debian · bookworm
- [tomcat10-user]Not affected
Source package: [tomcat10]
Details (6)
10.1.55-1~deb12u1· all · bookwormNot affected
nvd · tomcat10 · debian · bookworm
10.1.55-1~deb12u1· all · bookwormNot affected
nvd · tomcat10 · debian · bookworm
10.1.40-1~bpo12+1· all · bookworm-backportsNot affected
nvd · tomcat10 · debian · bookworm
10.1.40-1~bpo12+1· all · bookworm-backportsNot affected
nvd · tomcat10 · debian · bookworm
10.1.55-1~deb12u1· all · bookworm-securityNot affected
nvd · tomcat10 · debian · bookworm
10.1.55-1~deb12u1· all · bookworm-securityNot affected
nvd · tomcat10 · debian · bookworm
Observed:
References
- [https://access.redhat.com/errata/RHSA-2026:36787]
- [https://access.redhat.com/errata/RHSA-2026:36788]
- [https://access.redhat.com/errata/RHSA-2026:36789]
- [https://access.redhat.com/errata/RHSA-2026:36790]
- [https://access.redhat.com/errata/RHSA-2026:36876]
- [https://access.redhat.com/errata/RHSA-2026:36877]
- [https://access.redhat.com/errata/RHSA-2026:36878]
- [https://access.redhat.com/errata/RHSA-2026:36879]
- [https://access.redhat.com/errata/RHSA-2026:37136]
- [https://access.redhat.com/errata/RHSA-2026:37137]
- [https://access.redhat.com/errata/RHSA-2026:38505]
- [https://access.redhat.com/errata/RHSA-2026:39188]
- [https://access.redhat.com/errata/RHSA-2026:39189]
- [https://access.redhat.com/security/cve/CVE-2026-34486]
- [https://bugzilla.redhat.com/show_bug.cgi?id=2457027]
- [https://ftp.suse.com/pub/projects/security/csaf/rhsa-2026_36788.json]
- [https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-34486]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2026-34486]
- [https://security-tracker.debian.org/tracker/CVE-2026-34486]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34486.json]
- [https://socradar.io/blog/snowlight-government-chinese-campaign/]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1955.json]
- [https://www.cisa.gov/known-exploited-vulnerabilities-catalog]
- [https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34486]
- [https://www.vicarius.io/vsociety/posts/cve-2026-34486-detection-script-rce-on-apache-tomcat]
- [https://www.vicarius.io/vsociety/posts/cve-2026-34486-mitigation-script-rce-on-apache-tomcat]
[CERT-Bund public advisories] · [CISA Known Exploited Vulnerabilities (OSINT)] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]