Live › vulnerability › CVE-2026-34486
Go to dashboardThe fix for CVE-2026-29146 in Tomcat 11.0.20, 10.1.53 and 9.0.116 contained an error that lets the EncryptInterceptor be bypassed. Cluster (Tribes) traffic between nodes can then go unencrypted. Apache rates it Important and CVSS is 7.5. Only those three exact releases are affected; earlier and later releases are not. Reported exploited in the wild.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Apache Tomcat | vendor | – | – |
| Apache Tomcat 11 | vendor | 11.0.20 | 11.0.21 |
| Apache Tomcat 10.1 | vendor | 10.1.53 | 10.1.54 |
| Apache Tomcat 9 | vendor | 9.0.116 | 9.0.117 |
| apache tomcat |
| vendor |
| = 9.0.116 |
| – |
| apache tomcat | vendor | = 10.1.53 | – |
| apache tomcat | vendor | = 11.0.20 | – |
| redhat jboss web server | vendor | = 7.0.0 | – |
| redhat enterprise linux | vendor | = 8.0 | – |
| redhat enterprise linux | vendor | = 9.0 | – |
| redhat enterprise linux | vendor | = 10.0 | – |
| redhat enterprise linux els | vendor | = 7.0 | – |
| redhat enterprise linux eus | vendor | = 10.0 | – |
| redhat enterprise linux tus | vendor | = 8.8 | – |
| redhat enterprise linux update services for sap solutions | vendor | = 8.8 | – |
| redhat enterprise linux update services for sap solutions | vendor | = 9.2 | – |
| redhat enterprise linux update services for sap solutions | vendor | = 9.4 | – |
| redhat enterprise linux update services for sap solutions | vendor | = 9.6 | – |
11.0.20, 10.1.53 or 9.0.11611.0.21 or later, 10.1.54 or later, or 9.0.117 or later11.0.24)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813.
CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
This page as .md · .json · in your agent: get_signal("CVE-2026-34486")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.