CVE-2026-29146 is a high-severity Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor component under default configuration. It affects a broad range of Apache Tomcat versions from 7.0.100 to 11.0.18 across multiple release lines. The vulnerability allows an attacker to perform information disclosure attacks remotely without authentication. Red Hat's advisories confirm the issue and provide updated packages that fix the vulnerability. The recommended remediation is to upgrade to Apache Tomcat versions 11.0.19, 10.1.53, or 9.0.116 or later. Red Hat JBoss Web Server 6.2.3 includes these fixes for affected Red Hat Enterprise Linux versions. No known exploits in the wild have been reported at this time.

The vulnerability enables remote attackers to disclose sensitive information due to a Padding Oracle flaw in the EncryptInterceptor of Apache Tomcat. The CVSS score of 7.5 indicates a high impact with network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact. There is no impact on integrity or availability. This could lead to exposure of encrypted data or cryptographic secrets under default configurations.

A fix is available. Users should upgrade affected Apache Tomcat versions to 11.0.19, 10.1.53, or 9.0.116 or later. Red Hat customers should apply the Red Hat JBoss Web Server 6.2.3 update which includes the patch for this vulnerability. Before applying updates, ensure all previous relevant errata are applied. No additional mitigations are noted in the vendor advisories. Patch status is confirmed by Red Hat advisories linked in the references.