Description
Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.0.0-M1 through 10.1.52, from 9.0.13 through 9..115, from 8.5.38 through 8.5.100, from 7.0.100 through 7.0.109. Users are recommended to upgrade to version 11.0.19, 10.1.53 and 9.0.116, which fixes the issue.
Affected products
apache: tomcat
References10
- lists.apache.org/thread/lzt04z2pb3dc5tk85obn80xygw3z1p0w Mailing ListVendor Advisory
- www.openwall.com/lists/oss-security/2026/04/09/24 Mailing ListThird Party Advisory
- access.redhat.com/errata/RHSA-2026:20405
- access.redhat.com/errata/RHSA-2026:20406
- access.redhat.com/errata/RHSA-2026:36787
- access.redhat.com/errata/RHSA-2026:36788
- access.redhat.com/errata/RHSA-2026:36789
- access.redhat.com/errata/RHSA-2026:36790
- access.redhat.com/errata/RHSA-2026:36876
- access.redhat.com/errata/RHSA-2026:36877
Metrics
- CVSS 3.1
-
7.5
HIGH
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - EPSS — exploit probability
- 9% percentile: 95 · as of 12 November 2026
- CWE
- CWE-209CWE-642CWE-1240
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.