7.5

CVE-2026-34486

Medienbericht

EPSS 1.22%
Veröffentlicht 09.04.2026 20:16:25
Zuletzt bearbeitet 14.04.2026 12:45:40
Quelle security@apache.org
CVE-Watchlists
Login
Unerledigt
Login

Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor

Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.

This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116.

Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 5

NVD 3 VulnDex Vulnerability Enrichment 1

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Apache ≫ Tomcat Version9.0.116

Apache ≫ Tomcat Version10.1.53

Apache ≫ Tomcat Version11.0.20

VulnDex Vulnerability Enrichment

Diese Information steht angemeldeten Benutzern zur Verfügung.

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	1.22%	0.792

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-311 Missing Encryption of Sensitive Data

The product does not encrypt sensitive or critical information before storage or transmission.

https://thehackernews.com/2026/04/weekly-recap-vercel-hack-push-fraud.html

Media Report

https://lists.apache.org/thread/9510k5p5zdvt9pkkgtyp85mvwxo2qrly

Vendor Advisory

Mailing List

https://nvd.nist.gov/vuln/detail/CVE-2026-34486

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2026-34486

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2026-34486

EUVD