Описание
Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| tomcat11 | fixed | 11.0.21-1 | package | |
| tomcat10 | fixed | 10.1.54-1 | package | |
| tomcat9 | fixed | 9.0.70-2 | package |
Примечания
Starting with 9.0.70-2 src:tomcat9 no longer ships the server stack, using that as the fixed version
Fixed by: https://github.com/apache/tomcat/commit/6d955cceca841f2eabf2d6c46b59a8c7e1cd6eaa (11.0.19)
Fixed by: https://github.com/apache/tomcat/commit/607ebc0fa522bd9e8c05517baa2d179bbd1e659c (10.1.53)
Fixed by: https://github.com/apache/tomcat/commit/0112ed22abfccc3d54e44d91eb08804d0886acd1 (9.0.116)
Make su to make the fix complete to not open up CVE-2026-34486.
Followup for incomplete fix:
https://github.com/apache/tomcat/commit/1fab40ccc752e22639eccfe290d5624afad7eccd (11.0.21)
https://github.com/apache/tomcat/commit/55f3eb9148233054fccfdf761141c6894a050be1 (10.1.54)
https://github.com/apache/tomcat/commit/776e12b3e2b0b4507b8a3b62c187ceb0b74bf418 (9.0.117)
https://www.openwall.com/lists/oss-security/2026/04/09/24
EPSS
Связанные уязвимости
Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.
Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.
Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.
EPSS